5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe
Size

78KB
MD5

d0a56e91506e31afed1528451fdd82dc
SHA1

4d80feec5c3e7df1d2ce77ff83f353861fe2df5b
SHA256

5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb
SHA512

e1cd0c7d277106553f2944f552667cf62f59790a9c080a05dfeb10adf13e953fe96d7ba0e674a950a0b6386158b25c15524418dcf3541be4aab55f27dc234b1f
SSDEEP

1536:bEuHHuaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtMj9/S1kh:YuH/3ZAtWDDILJLovbicqOq3o+nMj9/b

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
792	msedge.exe
792	msedge.exe
64	identity_helper.exe
64	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 792	4736	5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe	91
PID 4736 wrote to memory of 792	4736	5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe	91
PID 792 wrote to memory of 4384	792	msedge.exe	92
PID 792 wrote to memory of 4384	792	msedge.exe	92
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 840	792	msedge.exe	93
PID 792 wrote to memory of 4472	792	msedge.exe	94
PID 792 wrote to memory of 4472	792	msedge.exe	94
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95
PID 792 wrote to memory of 2588	792	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe
"C:\Users\Admin\AppData\Local\Temp\5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd5d946f8,0x7ffcd5d94708,0x7ffcd5d94718
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13419531569545159631,5265296785032935834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5267a5cd0ab12efe77232a4395fb3fdd3267af33e129903121abb7cc69b1dfcb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd5d946f8,0x7ffcd5d94708,0x7ffcd5d94718
    3⤵
    PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d53c6c6-596d-4637-8743-8725632fcfae.tmp

Filesize
6KB

MD5
d9c86da79ec0fdf0c824fdf6b760b669

SHA1
06241e047fad63192d308a65fa0070c280eab8f0

SHA256
96fc7caef697e59d6df9f4698292720fc12b4615799e9b3c4ca2e91b45d988eb

SHA512
859fc3affb71be919c0bd4518450b76cfc5b7726eab011d93260d546f7fc35917464307403c9bce83b0b5b8794cc43e14ef614f825e9922eb91cfc392c56ed3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ab91029cd1ac505a9c1299d4612e4508

SHA1
a5666cf2e9575598e4c9d37363386d8ff7404502

SHA256
6cd4622b0b451acbbbc35003551df1112d13c4dc75fb13a24dc7c3ed89703c05

SHA512
7d7fd95f657f1ff184ab0a1825eb4bce2764db2f11cd98d53efc03450a87323cb9d55fffc086665f5dda83787e0855a8042cc6dcf68011b831d3b9320d60ae2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d221e8bb76938d2739e7a42459f3db6b

SHA1
fd1775c7066bef65701bb817306ba377ad78c408

SHA256
62b09c0e58518b5e7121f2d78b64c30f97b3bf9cf221d4845592686a89721996

SHA512
3c7a0bb8378aebc2a24bcb78b8fff7f066b711b283ce6de0ae2ba3c0a975e7d5710c222ec61c48cf3321f8e363e60287d1330fcec6f8b3efd9299a8ad65bedd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76f31c1d25d62608f4fc831269b45c77

SHA1
60b27bc74688d386cd44f9f663473188ddd651a0

SHA256
09bda1de1b3ffa4a35a957dbd67d9c9298695eaea3582e4a4c43f6b2e4169460

SHA512
f35a5712db506be78b3e0b75478abdba64991b03b7934a59dbe6069a177ad618676ee2a845ffa30acd6669ada13fe7c76f467830912e925f8c4aad271c85e44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
6b122e975352fe05227169c65a1541a3

SHA1
c722abeb037e5e193d92eeee4a6a045863e3ac99

SHA256
343c09a53d049838d62b201ff2f0cb20bf5a4c2d593a276edd0e15a6d6f8337e

SHA512
e7a6ac481140a012f24d8fa6dd266cf40d3bc0ad6e28ca05d181801a64368bcf5852817856b24364f60fa3dd50de49c86e37358621658e97e9ea7ae283a15295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f81b.TMP

Filesize
369B

MD5
11391e8e837439f4728f5b9a8e46fedb

SHA1
2408ca2d4fb2677472082f240b27ce2758c062f7

SHA256
d4fe960318e02d3649b29345ab39b48b56b2c314b9fb891e395df8853557de1c

SHA512
74f89c75d27794b2a35c082301fb1b01688fdfd107ce870568537ed442185c4e019deff8e08193b4028b4ed8de963e12e4719f9853adfa8172c361b17d730a66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77dcb010458edf9e15a2bd0269583ffc

SHA1
f2b7ba2d28472b583eef344fd4af3c1658fbb0ff

SHA256
a7eac75fc9d981b67cab30c658d290a4f0aed00fb63d0fc9eb2f9c1e4278b21e

SHA512
79a3266138a176341b62b46b8e098c9624140569b0ec1790645d03a8ffea13b4eff3f8ef106a25be8d3fd63a7591adc6780636dd531e3ba588db8b0dfbd3e3d2

Download Submit