6eaa027edff4ad0f291eb3b3f10c7195c74baca318e76be0cbf99e04d7c5e149

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe
Size

52KB
MD5

1a4ac0f78511c028b51e0b302b080946
SHA1

cf5d9e076aabb18759dfeabf59f4328f3fe30088
SHA256

d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e
SHA512

c38e8742bdfc93aa4b6ffc4789e4e1b844c276bc61eff07729df70781d30ad9f2aab2b2d0290235d828bc556be996f53ded0441440c93b1249abc6e03c855bbf
SSDEEP

768:PKXTZ38f7CTv8FwKrM+rMRa8NujBtUmQGPL4vzZq2o9W7GsxBbPr:PiTZsTCTv8u1+gRJNA49GCq2iW7z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
3500	msedge.exe
3500	msedge.exe
2036	identity_helper.exe
2036	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3500	4856	d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe	82
PID 4856 wrote to memory of 3500	4856	d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe	82
PID 3500 wrote to memory of 2756	3500	msedge.exe	83
PID 3500 wrote to memory of 2756	3500	msedge.exe	83
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 456	3500	msedge.exe	84
PID 3500 wrote to memory of 4876	3500	msedge.exe	85
PID 3500 wrote to memory of 4876	3500	msedge.exe	85
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86
PID 3500 wrote to memory of 948	3500	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe
"C:\Users\Admin\AppData\Local\Temp\d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0a2446f8,0x7ffe0a244708,0x7ffe0a244718
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15282908669481588395,2912342368485736314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d59c7ccf805724c5a8704e0ed9e457bfe33b61e150d646c1da2703e30c22da9e.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0a2446f8,0x7ffe0a244708,0x7ffe0a244718
    3⤵
    PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
c738c78159125f20cb48b581c20a10c1

SHA1
caacad16ca304b646876520dcf283b01ad53e73f

SHA256
0ec8e27308bee7c302554941ec6e8d6a4b9998fe87da58bd505b10dc00e16985

SHA512
f9262ef43acd63c76d50c6d44c87c0fddad7c8f26da6291a7bdf7e894613b9b66f9962e7900290b730b4391b38efc653bf3d30a754696d7bb9af6dd018832b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ed644a554f1ac92b4446fb727503d47

SHA1
09f9622e588f7f0aac97b26ac1d7e9819e08d8ed

SHA256
504cca8aa75aaa540e8915811d4f1df7eafeda67f4bee59e7fa8cb664856205a

SHA512
a400c7136290d1fda604993657abad2072c26aa4c2775e4d6b4fdf6b19429e7868c260a37de45c2281f3f28443775e73a6b5c25fecd76815b4364ddd59a36722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46ae3b117c7292f8817f3ef2291f4499

SHA1
5b8e6571a97c947279b6f9c22ad77b81c71b7563

SHA256
caf93eb280744f24d27d7dda9281937003b18240c30f00c9e69edcddec1b5aae

SHA512
320a0bc6b390d4d9483bd5137c9bff028856f17c329c5aaf1dc46da8d10e9b37c3a7fdc751537430732810b854100666e2c41dd0495de950487ffce2a02d0fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20fa390d381c67adabb86c656ff58539

SHA1
15cd3e4a4589b16923a8745e69a8995acdba88ad

SHA256
0a29480c0d80aba51fdbecb651bc11a09a63c281b40a50a8049de6dc5c6d98a7

SHA512
6bf00e07261f8d090761ad83fb10050480754b76f1b7a9324d0ff15ecf26c1d7ae62720c53c40a538f3024487ce094bf2a9660adaf2e7165b481aa709b93a644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4571db4a31adfc440194300e9511831a

SHA1
34b08bf982953af29e987880f7dbcad042cbce7d

SHA256
75485f2eea553ec628be6a0173ccb40d978cfa8b36f1798d5ded430940272a9d

SHA512
d1c927a3e8c77d88ff1d9d4367271d2733e575df1aca5de81206f0fce564008719547815a0f64fe44daf3fdb0afd65efbb1ec0e7c8afa156e749ab040606a30f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f06b.TMP

Filesize
371B

MD5
9fa71280c3efb53f641b4428bde1a692

SHA1
5a18fff68770ad849018aefb214702df087e1382

SHA256
78ae3384240dd52636f5aa496d3976b4292627654eacef0c286348a511ec1408

SHA512
681f485c15bc2e3d6345ae6f7265d1986aa68b7593133de9f95e8589ec97b208574ba8a15ed5ec7a53804e4363e29a5393fc30dd721783a622bda5bc71c03226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c04246ccec73f1baedc2ebf68e5f33f7

SHA1
b6a835d68d9d93df3e98fb1b0394796431f1431b

SHA256
d96e339c50a21f67c129a8bdeba189a93a18964db0e29727dca279eac14adfd3

SHA512
eed4e30e85ed048074c1454113730d02f0d346847c8fe174444cdab0f6471f4b0c34514bccd7e4e8b9c250d61ab6c3328c3f2cf0b9a07d2c8815a82e178e2008

Download Submit