11edb2122d3a6c81856c571afc2d681307ef18d10af83770e6bcb848213f7bc8

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24201220x00000000002E0000.exe
Size

192KB
MD5

b04d25a81e8b0075ffcafc4179c079c8
SHA1

bc74ce8ec2da5e3e6dfba6a87d04b0e3c291bfea
SHA256

11edb2122d3a6c81856c571afc2d681307ef18d10af83770e6bcb848213f7bc8
SHA512

658ee71645396c55f1ef9c72fb1fa3c52367fc07396666860542fb5eb9830eb5b01b5c64cc6c7236fda4a1ff847a842bd54e37b71a291e66210ad7f3b1be7ccb
SSDEEP

3072:OO64zyFlJDGx0HqSYxNXUfMim4G3B8e8hE:if1s0HZ8em4G3B

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
2812	msedge.exe
2812	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2812	2100	24201220x00000000002E0000.exe	85
PID 2100 wrote to memory of 2812	2100	24201220x00000000002E0000.exe	85
PID 2812 wrote to memory of 64	2812	msedge.exe	86
PID 2812 wrote to memory of 64	2812	msedge.exe	86
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 2508	2812	msedge.exe	88
PID 2812 wrote to memory of 1692	2812	msedge.exe	87
PID 2812 wrote to memory of 1692	2812	msedge.exe	87
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89
PID 2812 wrote to memory of 4140	2812	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\24201220x00000000002E0000.exe
"C:\Users\Admin\AppData\Local\Temp\24201220x00000000002E0000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=24201220x00000000002E0000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8534046f8,0x7ff853404708,0x7ff853404718
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6150702743891603607,18252797365021293329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=24201220x00000000002E0000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8534046f8,0x7ff853404708,0x7ff853404718
    3⤵
    PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
622af1d10297d5f6a926acc4369f02df

SHA1
dec8d046660e8954a01bf15480c31f29020c202b

SHA256
20bcdd98eca867769b58c65f46e4ec75415686ceb8e8724f2ab17770fa6a0f3e

SHA512
3bf06071a202009edf95a1853b298d76359513941cee224e3f08bf29ee39cad58e9269a2af47f8649decb8bda6b2d7bee0f999f54acaae7d375ad511496d3471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e667470105471f793e56910535335f6b

SHA1
7892034556eec6dba44d63c885257ef628368a94

SHA256
53f2f582878dd73a8fa24466b0947fb618e998f325fa0ff55b79770b59d6feed

SHA512
7c95a48b656595f0020262726b68c3a5eceb3a9c0a3593aa59a72076a06b8b9c49991547d4a15e8bc78052359ff3fb5e22438042c667db40cafd1bc0e5f63a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1544e1f59eff40d3a122bbfe557f046

SHA1
c1ab6eb50c7ff19fb94a6b71ed4ce6e6e8f4a068

SHA256
e06f6a5bdafb7f9eaf5163ed528e2a672f2b72ca9b4a62846a7418f5221ad0a5

SHA512
ce198f18a27d721a359e16299fe94dc37f5277c002cad16caa03c102b7ac0aabb4e02e21ebd44d425d5de5c0aebd456f85bb9d25569588fe2700aa445b2126cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1729135d2a42f121e6e2c8275db1a518

SHA1
14cca752b541ad5529c13f65dc375cc4d39156eb

SHA256
e5b0c85cc68896d2f89ce7d1d212e1eda44786b70c1157747b6c5e607037bc56

SHA512
cf9f855c29bc1bc9f2a95fdbe2afa816b7150d2568cf5bbb524165fcb6c332bfc368f3ad56be3135e1a67d11e85a4e22eae47178e0de744d8a7a2d198baa768c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
32d8f5d4f9321aa4d0ef88d25bf48588

SHA1
ad8912f9b880add563dd8341f27ddf2c1a590086

SHA256
184711e6c7a181e9643c7d4e70dfd038992d06e8b376a1e257d555738d950886

SHA512
2e374c4baa64255c4c333be762613d45cd6b1ed5ae27e774b767f73e89c111871b68b50db0f5f5829e1eb4f4ed8403ffc0b76e88c36a041138bfc611b8217579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5881ed.TMP

Filesize
371B

MD5
c7616bd1abe1613860c52b0343f217ea

SHA1
a5923e9888846ef4a4c83cb008b9b4d72684c610

SHA256
8ef4b2146746c38a21965d62772f9876fa8f4365afc4953b2ec223d0a7d700eb

SHA512
24c1263dd35065ca79988dbb9313ddb7c4747465e68d3af095b20c4b2705bc359d12e388bce2da55221d0dfee4946c196c7e6ab14124ffca7dfedcac66e79454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1ef6f312f65e96ca5f0435775f387f6a

SHA1
fec120d7140cade20e8bffb5877a87f77e57375e

SHA256
d55f59f465ff56e2a098bb73b2d9360950af6d9a43ec3020ae56a57cb69a2fa4

SHA512
f7baad0e35ee8477f28324f2bb00d86fdcb0effd6fadc9f452030237f8e7b96dbc831bd0aaab5786cb6e5712f241ca883498334ee0e62555a6c95e7a527db6a8

Download Submit