9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09

Analysis

max time kernel
98s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe
Size

202KB
MD5

fc5bcc29e3633aeba989519021e41700
SHA1

cea179116ce5eb2597f2d4aaed0459bd7d8aa6bf
SHA256

9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09
SHA512

aac356d464f639347c4e12e3f66a382666685b102c5d1b020fc796f85e9fb4988d3b7310f11f6abf98a356ffad3428c0c565b84bf8277920ee9495ba30b64e98
SSDEEP

3072:DzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIHF8JS04/B4tD77heYN1uadhNJ:DLV6Bta6dtJmakIM588PhhekEWNJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
1596	msedge.exe
1596	msedge.exe
1012	identity_helper.exe
1012	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1596	2708	9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe	96
PID 2708 wrote to memory of 1596	2708	9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe	96
PID 1596 wrote to memory of 2188	1596	msedge.exe	97
PID 1596 wrote to memory of 2188	1596	msedge.exe	97
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3124	1596	msedge.exe	98
PID 1596 wrote to memory of 3284	1596	msedge.exe	99
PID 1596 wrote to memory of 3284	1596	msedge.exe	99
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100
PID 1596 wrote to memory of 4928	1596	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe
"C:\Users\Admin\AppData\Local\Temp\9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xc0,0x110,0x7ffc5e2446f8,0x7ffc5e244708,0x7ffc5e244718
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2645071127007643693,14008630453103331031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9bb87ed6671178618f6f8720169c2fac3688564b53dea81ed5f5f999290afe09N.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5e2446f8,0x7ffc5e244708,0x7ffc5e244718
    3⤵
    PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d937d8a88d39a2a228691b2d874d01b0

SHA1
6d7469e141ba05212b76d97874d06c5e9c637e78

SHA256
a05d29404197ab203533cb1efd466c6a949f9d8a2d02b5c2abc8baf9c33b45f3

SHA512
938323d403248ee375d380e4d49919f79575767dee2183a4e94834bfc360288db4fa6a0c110f2343a599b2a7d790c545f51457872f367f3f85d0961acf6a10e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8851047202a29772b6842e4f32d2f6c5

SHA1
35485c165602dab5b0e98d978ddef5800eb42fe2

SHA256
92ac14c87a3d983422f5b934677fa2ff4232378c3a00b92663be4c3533e18b9a

SHA512
d096d7de020c75d4329129412d0e1e2a57df679a904dfbb5ed31cbd29b309e51527991c3ae284bc492ab4b7372e8c97c6eb11932dfaaf8734a59bc14f9537193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6856d925006eb5caac6a923ad8757da2

SHA1
7ac8c2198d2ee2cb610d5e31e36499fc3aadabeb

SHA256
85ad4465840aa3bda24912d039aae8ee6e9049ed4e9df0ca05653da8f83d3f24

SHA512
f5127f5931936307644207f356ddf7d4cf969e5a8b9993d131893f29acd5ceb63426d5784456707c4062edd87a278b15b44faae0b8b8b711ea016c2ca912c55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c1837527836bccba4a84ee8049678c9

SHA1
dc1ef2fa42462138bbd8fe753c7ec569429478f2

SHA256
31f2fb8a325197b01c5ddb03e3368660157cbec2e2be2ebdd795b3e668572583

SHA512
7743aa65bae261214321c75846be35799570d328224f4850c51b55ed7a142a0536bfdc0aee60c387d913b0ccfe151ea8b777ddc65bc02674ddf3a71f6ab3f40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3601059d7620b5b53af260564555b9ab

SHA1
44bef56fafe40a8f43f2ba53dd3f42f0014acdd6

SHA256
29ffa13f507d3f9b913ab86e47a60f3a34dd2a78a3c0fadf9b19d0c79ef2bc94

SHA512
7bcd8705d1aa3afe6588285e3c2b1e3a7db97f54a6108e0817d8d539117e1fb21f1917d4aadbc4c93b9a3d243b72f07b3157ed297f2c8a7fbad87d340256e2c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581edd.TMP

Filesize
371B

MD5
486c4ea7d362dcb61207d33de724aacc

SHA1
8c3be1c5434a5e8f027ad47153e127b2af814399

SHA256
937b08aef30d6960547c7e2bd33cf350f15df6beab274357cb3ed6f9167590bd

SHA512
55e406d567863fd4a861c693c1c6393773625b5cceacb25210b924a3244dc2866e62cbe04f267d7cc455d9a00bbd5118bb54f9638be8f27bf9336755deaedd5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3fdb033e9dcf1a571f7829b3525ed65d

SHA1
1deb2350c2b7f0e26c6c626d3357709fb9eca0a9

SHA256
d9305f21077f3fd61d55108b80b79ca5b3b29e55140c8d64bf67287e27060311

SHA512
42b0e773a51710d4318bb2671d74469a1342ed87da961b4a08bf05980bdd241e5da6f163bb2456746c42797272c4e6f13f56be0aa470f7bcaa345b1d98c02d91

Download Submit