be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6

Analysis

max time kernel
116s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2025, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe
Size

110KB
MD5

2979f605152d0749eab23334d49cb571
SHA1

a86e2e96a450768594af9ef0dfb39b6f73fc75e6
SHA256

be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6
SHA512

9474107c7f2a23bee7b3d504b8f4c8fddf45ccab71724726e01b8fea8541652bf675b641db3a9cd47585c27aa76c5aa95d3cdeb6ebad8a85f310f56212767963
SSDEEP

3072:wgb/ijm8my0UHMbJaH29jzZykMqtLGmbQ2:Vijm8my0UH4J029fZlp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
2348	msedge.exe
2348	msedge.exe
4728	identity_helper.exe
4728	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2348	1764	be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe	86
PID 1764 wrote to memory of 2348	1764	be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe	86
PID 2348 wrote to memory of 3760	2348	msedge.exe	87
PID 2348 wrote to memory of 3760	2348	msedge.exe	87
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 232	2348	msedge.exe	88
PID 2348 wrote to memory of 216	2348	msedge.exe	89
PID 2348 wrote to memory of 216	2348	msedge.exe	89
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90
PID 2348 wrote to memory of 3712	2348	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe
"C:\Users\Admin\AppData\Local\Temp\be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecc3c46f8,0x7ffecc3c4708,0x7ffecc3c4718
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13950291889584414690,11437758404166086404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=be35dcca3f9fffa093e8260b71e5527ac4f5b3a578399a86be4b2a9128f310c6.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecc3c46f8,0x7ffecc3c4708,0x7ffecc3c4718
    3⤵
    PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\939ba877-d193-4fe4-aaeb-c3781db1dd2f.tmp

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
de7a7638a2cd38f44360b6453ca9f9ab

SHA1
085be73aca8e57590cdb754aa7dbdb1cd1b4eb76

SHA256
8bd450572c3a5ac9b0a3580a89f17e7f3db00093e4499340dde8231beaa7b54c

SHA512
f50f01178cb9baf61da6f877eaef55df9cbec7c10b699c4169b95bf67679f95de53fdf20d07680fc650d46704fdf93d7b9c61689205da238d2d7f986efca476b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d95890a8591f26187fef361afb71619

SHA1
a0816fc513e6d83a6e7603fd334b36c401185b7f

SHA256
b82db46d7641d34550343e93716decba55eabd8fcac628a17fecae5f97b09f2d

SHA512
92f301361c32212a217573753a51baa0db43a9e6ff735b660337255a61b3973bfd86e0bfc17155d5469ede3904fe89e1d2d5a1d95f3f3bd74c703f4a96a9a13f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7a01804a00357b9cfd1e6ec4249fd3b

SHA1
efaaf4566982a854a3c2c5eedaae671ebefdaeff

SHA256
db1f36e47a0b5ed26ce8f5ffc44b502408274755cd80bbf59e2b2a61a476a304

SHA512
16311942cf5c1bebeb34d9fe3f19c3c5a92e80fed56584c41ab92c7a9d6041bc29b1161ea921a40020b606e5d5ba95f6ad1f8527c62f1470e083603c14ad4f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b64d07f67cba5ff9c13a5cc73ea3e98

SHA1
42ae81d06aa32799895a3eedc4423cd08b1bf8a7

SHA256
17158b0d94044c9f06be9805773ece6a40c55f742cdafcad44843fc7bdc628d8

SHA512
b0a098a08fa6aa13463b06835c9889699739c3930d2b5584e4a7290d35d9799b691eb1dc1861824bc8cf1bd5f939ac124fbea6b8325408b019bb97eff7f09b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9c6a1adc882bde4b8eeb27145d3c3869

SHA1
5f33e070b4b6f1b3eb9e4acd979e9ad21e33bbe8

SHA256
cd552da9a505a9e6eee55c4102697d929bfced91c644e58d28244a7bc39451c5

SHA512
73d8e8bce8ce5601ef794dbd267c20997befaa180e73d50e9e96327b550e52f941cc0a6ce192b08a6cbe3450162e13a091e7708b00f7b9598f37a5eadc00063c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817b9.TMP

Filesize
371B

MD5
1561c380366b3b7e493b875ed897c843

SHA1
8f27ea3306f7b8972d145dd939c6040fce182ea2

SHA256
a88351de56313f9d431365662522dbc841c494669dee1e5fed078e061d93e8ae

SHA512
6ad5f77b20e22affe1da76b37d1ec8332ff8d51747434b4cadd152598fdb3640591a3e61a0a2bd9ff6da65d3e10649ecd0f48e6f0be3c6b7ac19dfb4ca5ba455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
085f34b7e7df0406fe21e685fece0c9a

SHA1
ca513c3e813ea16e08d742658219fbb80193f154

SHA256
0d03911bcfdd5e41150d9aba06f910586d14872e21d113ac71e6283309005109

SHA512
aef3b71e3c9da0e91934ed6f9f06cee182d8583749e3259f89e3dd068027c886d2a569343cbb296468a26dc7dc6774e3c377d3c1c52f5a15de9495d4363107e3

Download Submit