6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2025 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe
Size

844KB
MD5

35984ca66f2355a06fb5ab3e0fde68e4
SHA1

0d7178cadd0f6ffe564fcbdc7769ebd4319a2984
SHA256

6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519
SHA512

4ae34c2489c41f629be939c0638b2a72aa831d6b525770052cced24e1d4a23d33f21394fa9270f9112fc161557d700b68ddb61dd6889190bbdb6429d0c35eb0f
SSDEEP

24576:twZS04YNEMuExDiU6E5R9sdOQnQ2M2FqIbj+r:Kb4auS+UjvxQqIbj+r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
692	msedge.exe
692	msedge.exe
4540	identity_helper.exe
4540	identity_helper.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 692	3548	6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe	85
PID 3548 wrote to memory of 692	3548	6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe	85
PID 692 wrote to memory of 1064	692	msedge.exe	86
PID 692 wrote to memory of 1064	692	msedge.exe	86
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 2404	692	msedge.exe	87
PID 692 wrote to memory of 784	692	msedge.exe	88
PID 692 wrote to memory of 784	692	msedge.exe	88
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89
PID 692 wrote to memory of 4528	692	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe
"C:\Users\Admin\AppData\Local\Temp\6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa909846f8,0x7ffa90984708,0x7ffa90984718
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16971911251948640417,1519864510662027774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3912 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6444041cce979526b0bd7c1eb7e8d64f469dd55e48acdca70e605148a3124519.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa909846f8,0x7ffa90984708,0x7ffa90984718
    3⤵
    PID:5280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5da507c2059b715761792e7106405f0

SHA1
a277fd608467c5a666cf4a4a3e16823b93c6777f

SHA256
8c1d99de087ac5f2e7b2afce66eff36a646bef46800c0c1d7737d6f0df74b7e8

SHA512
01c92729dd8061aa122b116a674c73bb78016f66d2cb8f7fb64907352758a825e87a1e345334386440699d2a6d1e17baccb400c5aee151eb64e64019cbebb870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c6e13dc1762aa873320bed152204f3c

SHA1
38df427d38ca5ce6ce203490a9fb8461c7444e12

SHA256
5c441148843b7c8dbff4c4a72962a532aaf0bdd484d07a03dd9a32fd461b1371

SHA512
133054cb042e11013bfdad1bd11e3407d08cf26a66d0743bea9708d261aa904a1047bb0097b187ecf8436cb6cff3bec28c89e435862cad0e0fa264799556b70c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a43f0c64d47c32d385ee001e7eca3e66

SHA1
610795523d757977d646346ee5bb0891c5d29afd

SHA256
61d78f3c9483a1f4dbaff637ce04b0e73364cb469c225022173cf696fbdddace

SHA512
84526d4280c95aab2dfb13372ea633d843d485ac4951fe0314f56a43ae0d29903ab7b74845a3539915295346922ab884641d6bd150c350214df0e9a6ce0a5d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1541ac0b83793c093387de288d62f8ae

SHA1
b1cf8ee2b06cbfeb8437ad4c7e2341ec00960c9b

SHA256
a60ae48f28b902b8da374c3898235995967fc967fc49d0f54b0187c9f8a3ac4d

SHA512
50ac3d1c3290fa7ced2d3271ae8c666a1aa744aca1b93919444894145522a160e934ba33412153e0a26b48816b26f7090ac6fefd4957427bec0fb0e3297e002a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f116348dc040586f39acd61366316b85

SHA1
e0a8067e165f224bba549197e52e3ecb64102462

SHA256
f88f61f8d36acdae90f4023f4207e10c760e95753ce08b57c3e95d2f076e787f

SHA512
93c26f4a5de014fde34a58bd9f707a35a7b3651c10ff8d68c4cfebbb8aaea61dc3556fdbee8959da621b6c49cac0d00a64e38aa41ddc51ca1cd95d4def202436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
836470caf2f78827396a4191615fbf10

SHA1
4c41aa08bbdfbc584b31624785931fc1928a3c52

SHA256
d33ed12462f65e349e48272e261184a9defe914d18ea95a846985be869ebc956

SHA512
8d2ac49ec3376761f673d501240b6cbeb53fb6ff54e86a3de28bf00d8a39f6ae232d3ebcddb1297439293897aa769eac273449402d662ce7d31644bd05e2882d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
33e1860b9ee8acf6eae93afdeeae7251

SHA1
9a019bf7ead604bcb33b581db3feb1c60bdb99f4

SHA256
3840537904e288970b28e94601a46bd7e37b247e27f690dfe470a40fc6142140

SHA512
276affcfa3c85eac09370670db59cf571a2df680ad10d7cbec74c3de70cc884ee410a2c005acb44a70038ea44523925e9baf19e9617b835429fb6ff3fa4fc4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586b48.TMP

Filesize
371B

MD5
d9a5b77a617bcf8bd7095ecb0e98bd38

SHA1
bac1db4ef829eeedb7a2bd8006beb1017d6eb563

SHA256
7f2ed7baf2d475a09bf4365daf359936466b9d83f9aa79e83f09ec9512a45087

SHA512
1baed59eb605ab15a66b47aabd8653c4013e305c4ab0114c6af569fb6c0c247609c30a8be8e72ae9f3cea1a388449e87f83843da38607f2424ce0907d36e42f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
134738a54a2621ff22134060ebae5e93

SHA1
8b26b8902a79dc4aaefe9841a4e25a664604e41a

SHA256
d8542f0bf8b0b27f154b62e2f4ab4ee0896a442f90c72aeda384bcbfb2c89034

SHA512
b60e8a9b4e113487c0ece3e5820b01ce938517b0c71370a46cf21947914e8ca496fc1d884f6dc28496ba21a40d6701255053e55120ef58acd16b1397b8bd129d

Download Submit