6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2025 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe
Size

844KB
MD5

35984ca66f2355a06fb5ab3e0fde68e4
SHA1

0d7178cadd0f6ffe564fcbdc7769ebd4319a2984
SHA256

6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519
SHA512

4ae34c2489c41f629be939c0638b2a72aa831d6b525770052cced24e1d4a23d33f21394fa9270f9112fc161557d700b68ddb61dd6889190bbdb6429d0c35eb0f
SSDEEP

24576:twZS04YNEMuExDiU6E5R9sdOQnQ2M2FqIbj+r:Kb4auS+UjvxQqIbj+r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4780	msedge.exe
4780	msedge.exe
2128	identity_helper.exe
2128	identity_helper.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4780	1552	6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe	87
PID 1552 wrote to memory of 4780	1552	6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe	87
PID 4780 wrote to memory of 2452	4780	msedge.exe	88
PID 4780 wrote to memory of 2452	4780	msedge.exe	88
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 3396	4780	msedge.exe	89
PID 4780 wrote to memory of 4920	4780	msedge.exe	90
PID 4780 wrote to memory of 4920	4780	msedge.exe	90
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91
PID 4780 wrote to memory of 3116	4780	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe
"C:\Users\Admin\AppData\Local\Temp\6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0xe0,0xe4,0xd8,0x108,0x7ffaa20246f8,0x7ffaa2024708,0x7ffaa2024718
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11367129412484376335,4435051052176423524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3000 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa20246f8,0x7ffaa2024708,0x7ffaa2024718
    3⤵
    PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56361f50f0ee63ef0ea7c91d0c8b847a

SHA1
35227c31259df7a652efb6486b2251c4ee4b43fc

SHA256
7660beecfee70d695225795558f521c3fb2b01571c224b373d202760b02055c0

SHA512
94582035220d2a78dfea9dd3377bec3f4a1a1c82255b3b74f4e313f56eb2f7b089e36af9fceea9aa83b7c81432622c3c7f900008a1bdb6b1cd12c4073ae4b8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0621e31d12b6e16ab28de3e74462a4ce

SHA1
0af6f056aff6edbbc961676656d8045cbe1be12b

SHA256
1fd3365fdb49f26471ce9e348ce54c9bc7b66230118302b32074029d88fb6030

SHA512
bf0aa5b97023e19013d01abd3387d074cdd5b57f98ec4b0241058b39f9255a7bbab296dce8617f3368601a3d751a6a66dc207d8dd3fc1cba9cac5f98e3127f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ebb774fc8fd77318f281f43185307d9a

SHA1
a2cdb04539a2375418ba100c501be618a7e144ac

SHA256
f9fd7dcd2bd7ce1a57f4e4f31732ada5bd13a29f829760d4b687f537cbeb0bc5

SHA512
77aef876cc56dfb98332b1b9d19412d020a0612d824cdd3d224d0c8397e58c6bce95b9c6e94319b19e85a671ceb36f0a3945727b75dabcbf8cff5b570dd29d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8274119739671091a198ecf109b8ff15

SHA1
30ac6fddd981bdaad387e7d5434fd658a5eab24f

SHA256
2094c85b86f6ccbb2bd8301b0a692859bf32b00a0e30b8863c0214ed69a75e82

SHA512
fa38f4c768ac52bfee2db23c0d527202848dd948421807123edf5f867aa8255dd31ab3d5e8efe616236d20dd539de2d63ea7028e636ac93877be67904415c039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb0123332f2dc4fb67bd4a8d547feea5

SHA1
a3a0e40a6fee2a9073be4645751438a58d346b22

SHA256
53fc9b67c6619184bcd717bb6bd6fd74e39a19811abb48987e7835a2ebcc5455

SHA512
20d9ebc1527d218144bfcefd0f80b3fb6907e20056160a8d01a36e770c9c568920926c2cc4eb3a991d7ddf1f984f9a9d8c678e6653c6137c2a68de6aa8893055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67dedeb4b7a2b627fb1aeead6113e171

SHA1
7c25f5e89ca536d8b491b1aa9d0eadc5c39ddfad

SHA256
ea0cca212d8f700c0074b7600a2aaac59380d9d291baa31f39e497f623603ded

SHA512
baaea6ec19b05e274ccac1332f483631fc65c370421695457047ebce0a153410f9c976c973458690fba8b3552cb2c5380460d1d4f19253ce6a924d4339d55964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
7137ab2f23624e4ffc960ba20fd32ddf

SHA1
d34faf108e801b0ca162dc23113d8691463474aa

SHA256
fcbbae7d150c43e20b261de86ded512e4552b916b2667edba4fc6e974b80cf49

SHA512
d32bceb86655b0becea8872e4da6339bbce4b902740dcfdc15f7ac4a3aafd65adf1d47cedae210c8c1a2e9316535a3a070210fe5dca3a84531a6a00741f75844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589630.TMP

Filesize
371B

MD5
cad6610c82f542f29b5c5dfcd890617a

SHA1
fc6c6bf35aeef3a9a2835a5ef3fbdc8e482aebbc

SHA256
462982e7861daae07b573b0347bd437e3571bb4b288cf5dd39609265bb70633f

SHA512
833979c333b9f0ef348656fb25eaad0ae750d303ddeb0cc8033f2fc09b22216b9807744686770f1b19feb92473f07054e5ffd97c13645d0290caa43dc167819a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0ab6b5a7e38cc89b107345d6e5e7980

SHA1
862c69358024f2ab72ded00eae89a619357e0fcd

SHA256
34bfaa277e6bf2a27fc329cae1931d021dbc9a6b1b6fd6a6c979bbc4b9b9b4f2

SHA512
df8ec477f6e20ae2ab5c6b247556911c77b2122ce206fc26a762da3102358ae0e912e015b3de6726a586632e13d37bda32c14c53e083f4a60f41e628de99daeb

Download Submit