ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe
Size

256KB
MD5

b1a1c28ab1adbb3fc0e4477698091052
SHA1

e72bb00b3250d67b02f79ec023e04e97db784227
SHA256

ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba
SHA512

535ea340f0d03d600f9c5244134a7d1e35044dcd02f72db24ce2fc07efa504e9a731488bdc7a3d7718c53d7de1519b324033e7fd520c4f84e1aa1a5fc81fb646
SSDEEP

3072:6klDYDrrTD8GenSH63SatZTCafBMK4rxHUQ58KpVfW:6k+DrrTD8GenC63lbjaKuNUWpB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
4204	msedge.exe
4204	msedge.exe
2308	identity_helper.exe
2308	identity_helper.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4204	2988	ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe	82
PID 2988 wrote to memory of 4204	2988	ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe	82
PID 4204 wrote to memory of 1368	4204	msedge.exe	83
PID 4204 wrote to memory of 1368	4204	msedge.exe	83
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3268	4204	msedge.exe	84
PID 4204 wrote to memory of 3676	4204	msedge.exe	85
PID 4204 wrote to memory of 3676	4204	msedge.exe	85
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86
PID 4204 wrote to memory of 1260	4204	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe
"C:\Users\Admin\AppData\Local\Temp\ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce84446f8,0x7ffce8444708,0x7ffce8444718
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10116016346449282821,13059446132705071999,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ad4573519138b9b6e19e592fb046017a8337fe09f492670e104111bcf94e48ba.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce84446f8,0x7ffce8444708,0x7ffce8444718
    3⤵
    PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b4cd34231acea3c5c20b6a1a7a52db8e

SHA1
e48e5ac43cd320da893764c6e6c5439c9afe1b5a

SHA256
5add6a56fe9b905955bf6592a30c82ce1ed25aa54a5d3e1d333e1f5a73a74a3b

SHA512
b7ba254967c14e8841249d4b8fb7c1ecfec0cbcc4284d5e1746b732733a1ceb0343c2a6422c0b5b6511efea3118ef80d0755787d01470b88032670a7ec5fedf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f25fa25c00a37e66d3e9d29e46e6148c

SHA1
36e0467ad3f1fb2486ed7f30cc161210eab0708b

SHA256
9b92aac562822cf5ced635ac531fb9b2c5aad3d017f1e9a7b4fb05fb9ceada75

SHA512
ea35b3265352fa6e2cf9f4ddf998a60422dd7f222a726a9a5bae8e21ede319c7373a8bdf9e96f656cda2eabdaa0950a6a4ec56a0336536209251f54d05dd2e42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7979b2460e808befe107795a8398b790

SHA1
18dbda91fa0c3c460b541e168ca35feb939791ff

SHA256
9dc9b7095fd32f22f8011c39254948ec8cc353de75468f733932af521f555e23

SHA512
8bc40560a2e84b5c07c5bcdb542aee2f6dc8a5366e96b849e19e5234c3050ed4d5cdd496640a6841b46694f32e43e75be9ed8c5eb6783afac1012b2fd99f7e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c34179e184ee95b194f111b8b8ac943c

SHA1
9a381f90645fc5579f72955ab3f0e4b59aecc389

SHA256
3124136cb5ac9ca5b718becc046963b96b912fb61b3a3c5c958925f6c6de7de4

SHA512
d9908fd498bb70f5078ae5657c728759ef6c9b5402fbe67304e81812d8e26c53ee9594046a4e02249ea0abd7ca35d34821fdff0802186b7b6ca54eb8360c3a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4bf187d236d16bf8946cb98496dc3639

SHA1
e44373fb9157a905e213aab5b6da7bea997c0aa2

SHA256
355ca6d28cad6a274205e3499a87bdc281b95dff437c5084d3a365f5ac08f63a

SHA512
75d8794e4ec67fc29dd461236b593d14ff97a1aaacd43c8b82606e3275f5f83ec0108902103924be50faf49db56099ca664d6e7745639157ad89301a35dcf623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ec15.TMP

Filesize
371B

MD5
0142f2c4de5c235b406e49d508dda17b

SHA1
04cf7e8d4990f5c52b01c8c79d0f165171b70ce0

SHA256
3eb546d758fc640190d1305c9655de61399afa1c8ef98ba1e1b1792dbfdf1a6b

SHA512
60d91708027795a342ec76dc1f172f1e8c4632bacd2432779b2e4f5d4d995ecb764be1cd77ee6ae9a42cfbab72d6e33e62ef42a59a5a207e8e59a8ec1bb2a131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a74e6c73e3cbe25b6f97ffef6f356af4

SHA1
4aea5cf0f3662aa2839382e822239e579a7cd3a7

SHA256
e248886431710d359f58d77521010825605e5156ded4b18b6a8eaaf69f32a2f5

SHA512
ff2e6c7cecf7dfb33db36b07125cd4d200cb65880f10d1973da6e111d68dea8cf86ff5e168884849a2caa111ad98bddb9efc9e9d64235e85ca97bd896ac6d325

Download Submit