8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe
Size

17.6MB
MD5

f7fefddb5862abe0fbf40142476d159a
SHA1

0ee43653950f32f69f7d824623990b5a505e5821
SHA256

8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4
SHA512

1589e44fca6f3b253f99adb3ba732cf42165fec0bef052583bb27d1c87b7e45c5d7ca702b0ec9374ceb76a6df124ad7d51f5349be0f61e9c1da5e5d99e9ebc23
SSDEEP

393216:q+TCIHS4y0WyNUHKoc8tQsvcsM0wZzRA/Wbo:q+T77yx9Hpc8ast85CW8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
2452	msedge.exe
2452	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2452	2004	8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe	90
PID 2004 wrote to memory of 2452	2004	8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe	90
PID 2452 wrote to memory of 3620	2452	msedge.exe	91
PID 2452 wrote to memory of 3620	2452	msedge.exe	91
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 3336	2452	msedge.exe	93
PID 2452 wrote to memory of 3336	2452	msedge.exe	93
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe
"C:\Users\Admin\AppData\Local\Temp\8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd502946f8,0x7ffd50294708,0x7ffd50294718
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd502946f8,0x7ffd50294708,0x7ffd50294718
    3⤵
    PID:796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d842a2f1d9944ae0304a85453dac5979

SHA1
8488ce593931cf0b0e8c37be21f671d28ec851fa

SHA256
d1c2417ee42008373644123434d8f4287ec4c4ba9509953a388aa4502c7b180e

SHA512
c46ea68da4ce0b7fbe2019f873e8d3dc065181bf84ba9ec2573d152faf4cc52bfb593f618be03d23bb634915ba1d1570ac4c5cf6999743aa7cec749bb710541d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4892364ffc46cf4e40bd55de8a43dc9b

SHA1
31f587da4ae1cbe1b5b10b7ea794d57cc4f55aad

SHA256
3c53ecb099c36ba5e63fa7f6a64d51191cc94266988fd703c6920e77d8828473

SHA512
7a5e68ce831d888c3ea24077b2741a76dfbb945745557e307cc40ebdb148c9587199f8cb84dfc99ad400ec979c234594eaaa2400ca287c33569e36531ffe5d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
136c1bfa06e00eff9e72b5c1ef229862

SHA1
dcacefeadd0cb585c7fd5ba496b3597048ae4965

SHA256
636be4b37d02fccb13844d2f315c81abc7188d1b53ad0b5d1ac55ba7e710509d

SHA512
cdd8970fcc8e4879c46b177b315ce0ea65dcf5f5ce51412670cc8db1039975dd0ac68ebc2a99f98d0d0affec640aa4aa845b0b43e7bd5932d2d08d2829701d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0fe84da41ed6c2d7d0b1ebf924b1924

SHA1
81b8a4841a7c7e3cc3eb1fccc7f8952af30162b0

SHA256
762b209e2946c3960e67aa5c73e8710bf6770b775ce47d01b1e7b050ad4dd00b

SHA512
f339a0814347f0933b94e9d84268fff92d9d39d07bf894eb472527d946889f3e3ae3d1a569ba4b05aacec3c34c312175fe05db62e9709ab11c0adc3a8fbba72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
584d763e24ced22809f587dc7f1f0be0

SHA1
3bb0c97f6b27567f154b993e4c17f3b0a313c7db

SHA256
1db01f37152804996e384f8790825655db196fc94de951dd08dee5ebd419ddc7

SHA512
1287707850c0d78d589e07ed1c82ddd124985b5c1a14eded70f55847b7df2cfd37e6c207527ea3a5d73fc2144731e9cd033efbb3f68b1e99ad3da12e09c98339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583350.TMP

Filesize
371B

MD5
3dfcab3db42885b354cf17ab346be9fa

SHA1
5b0f46aed2f73c6581a86c20ac28e1ba6f701aa7

SHA256
94e3c576a484212cb6de01089e39ec5b807d2aa99847e524686e86918c4bcf76

SHA512
991f07da84eeb76f8effdaff77134a127245f25bf8c8608da4125bd577cca17b6c255562fb59cade8f3bb83f63b1489ef2a15774177959233ad77f7a6cef9024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f3b2815f5d4994d9c7f40f4573c7393

SHA1
6122bba36a70480a006c27fb8d5b79c541782008

SHA256
6d671ef7403961cacbd0c7b32d028717a9bd00378384ed4ddaef81f7e7f274bc

SHA512
049d730587f04cfc069a968085cd5afb916e75e2dc6c7fb88e836790a69b5d4dbd41c192c7535d99f88213a9c5ac6e61976b5d8c1d05fd26916f923384c4e85d

Download Submit