54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe
Size

237KB
MD5

8a13092049c86b21ff419b0dbd5e684f
SHA1

1202d06b12588978cc5cbb7ed2187f626ec02ad1
SHA256

54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9
SHA512

46b464992062270bdaf1b19aabdb0f3c9620c40d70a7c542aaeceee39382d8085e0f848aba85117a4acc3c2c8a1e874dd4225081647ec2a7a468379c06a6fa1d
SSDEEP

3072:CglEeWumuQ3UQSjH5J13lFbJgrG/jbo5ihpW0tfE:CgeeWumuQ3JSjH5nhBbZDW0f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
3644	msedge.exe
3644	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3644	3076	54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe	86
PID 3076 wrote to memory of 3644	3076	54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe	86
PID 3644 wrote to memory of 5116	3644	msedge.exe	87
PID 3644 wrote to memory of 5116	3644	msedge.exe	87
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 3164	3644	msedge.exe	89
PID 3644 wrote to memory of 1468	3644	msedge.exe	90
PID 3644 wrote to memory of 1468	3644	msedge.exe	90
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91
PID 3644 wrote to memory of 2312	3644	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe
"C:\Users\Admin\AppData\Local\Temp\54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff814f246f8,0x7ff814f24708,0x7ff814f24718
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12671509647200462327,5923135154629994550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=54da98e8e9453c5ec4153d7245f0bb745a4ecb360874c134f14feb4c3394d1a9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff814f246f8,0x7ff814f24708,0x7ff814f24718
    3⤵
    PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
995003c0344ea687961cd8acdc953a75

SHA1
4bfd77114cca0a186fae2e5f95d60e2e5926f625

SHA256
abaf81d9ae662d758348701b57175bbe1e0435f6901e728cec2eb52c611a28a3

SHA512
2e951a8940ce52b750a8cc56fbc871b15862b72fd7996123843f3fb894a7ace4036eccb460eb2343713ee645fcb1e095f62eb16f43577e6fcafea3f3bd912052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ff99d201aeb2f0da74f114573b15574

SHA1
347f9e1055e52d49b0cbd38e0b1468071a853091

SHA256
aacc42e6dfc70ed0fe346e4d8f40e22080a0aa07a942f1fae6cd22ec10ab043a

SHA512
664be029b027a462afd18dab0817b361c8dc651f7bcf5ff1220c80739edb0a1051aa57fc97f58620742fa94158e1013f62858b6563c6a57c6419bf55722a9713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07b3ceafaf34ec75ca52093fa0316036

SHA1
a1c75a91b9ef4ec1727dac63d2f64837e5e573ed

SHA256
99cee75eb2d2e264300305d6da85b5f61a69d6b5dee12a3b9a4355c0d7cd1a24

SHA512
7013b17d4331e266d2185c7289c96b55b51f208bcaaa23e4c4007e020e9fde36e548630682dfb2a3189908b27c9ba0cd5ef3d46177aaedab5f93de1248fbd6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f96cedd0e04c55ac5122ab3bcfb31300

SHA1
2716c6fedc0165bcea40bc028e144729eb9f4108

SHA256
2f39716946593afe8258534489b8a4ec777f14d013d2bb64915c56603646128d

SHA512
c544b2a59232d39c53610bb9bb13bbc40c2dd4d089c1cc15bce4699f6e7f9ad5b4a628464157eebdb2f6fcf2302a3f7ad19d55ec33ad779e2f37ee7123ae3765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
cd19b27467307e3153e51221a907ce18

SHA1
afd98dc696eedf7f53b7077dcec2303220ca7fcc

SHA256
bab25b8490de6ce36afbcc3772fdb9f33dbb6692d4d79a80cbfce31740960f5f

SHA512
264ebddbf33da6eb0d475efcb3a84596dd6f18d52aacaca0fb0d3bd3ab417b39879f7b8844643149960395531d53288b4c2775e6b3ff8669cd2e2a04212ea40d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e34.TMP

Filesize
371B

MD5
44fb662bb4cfabd6305ed969978693f6

SHA1
384f704cc3f9555be45e6cf30358936645947a3e

SHA256
8fbd27f87c2cb51ed497ceb87cfd84a8cd551b59da8a960066d6620dcb6328fe

SHA512
673161944c4d3c545a277c7f4345c25ff9442a3d6b36f4ac0aa33e79226748764dd2b5a3da1bbe12fa3b2c031d9610a2bb5b52364ed8c4cb4fd5814d5ac916ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b0d56f03bedd4eed11abf17309bc0985

SHA1
ed9549e70d91704f93673d0a949e4f33bd8e9d79

SHA256
054fabc703803421acf9d41ec532774bf670f07f6b6d05bf5fa06282b17a33f5

SHA512
34c798aa57a822c6b65e4f9c10e4f61699d2279d5f5c1272d45b1b2a9902c70c8d0727a53aa13c0c2efc9b386a0b05d567c119b9cbe6fca40ea94b9b46895390

Download Submit