d52d3e285ce8e38705f766f18f8c0307dfcb64d31c58af4fff4d70fe124f12a0

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2023, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1600-54-0x0000000000260000-0x0000000000290000-memory.exe
Size

192KB
MD5

4f50100b91dab829dc10139198ec27b0
SHA1

b393462228cc744427a9fa29481e57795af54271
SHA256

d52d3e285ce8e38705f766f18f8c0307dfcb64d31c58af4fff4d70fe124f12a0
SHA512

7c6fea282e822c743cb052dfeb563253ba5b364735ccedd15879f2bf3103c5aa44538a2d303863c4a9d1bb095d550ad55a5cca89b690d10d0513a7e1c70e8429
SSDEEP

1536:5buR0C10WqlVZRGWyuHrTog/XzMXMQ8ys88888888888888888888888g888888x:wR0feoog/ZpyqVEUCidWT8Fv8e8hQ

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
508	msedge.exe
508	msedge.exe
1484	identity_helper.exe
1484	identity_helper.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 508	4408	1600-54-0x0000000000260000-0x0000000000290000-memory.exe	90
PID 4408 wrote to memory of 508	4408	1600-54-0x0000000000260000-0x0000000000290000-memory.exe	90
PID 508 wrote to memory of 5104	508	msedge.exe	91
PID 508 wrote to memory of 5104	508	msedge.exe	91
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 736	508	msedge.exe	92
PID 508 wrote to memory of 60	508	msedge.exe	93
PID 508 wrote to memory of 60	508	msedge.exe	93
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94
PID 508 wrote to memory of 4024	508	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\1600-54-0x0000000000260000-0x0000000000290000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1600-54-0x0000000000260000-0x0000000000290000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1600-54-0x0000000000260000-0x0000000000290000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0x40,0xe4,0x7ffd61b946f8,0x7ffd61b94708,0x7ffd61b94718
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,780458528586765599,8683288983877368397,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1600-54-0x0000000000260000-0x0000000000290000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd61b946f8,0x7ffd61b94708,0x7ffd61b94718
    3⤵
    PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
cbfae2f68e71ef975ad1ab5a8ac48e6c

SHA1
b85d20e2e06c59841b1cb63a734631a93cb4946b

SHA256
2e5ad7cd64274f45445e915d213952f23ee6326d94146144731850c11b70d0c3

SHA512
974456aa4b8601ccc63f809264db2c6b7b10a00fb1f1f4083cf632778db55d54302861f960d3555a16fcad4d1ed968ba2aff9f6951888b6809916ceac296a116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
566B

MD5
381ac45cdf7aedc98e646056ccde4a8d

SHA1
168e192b23a595e9f41cf8d107d6c1d601c3ca77

SHA256
9f056538358e029a4a7f13bab71dec7dcec6a9ac69b95c766a887849faf49e84

SHA512
98ab242ae61cbeefe9816b68044a15f7118e2576c6e559fb1fb801cc405d4c81310183c6c6a31ab46791a1477d0f61ce113d98311f9858619e91a03935e8a4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
663317780c4f80a6facdb76865f42439

SHA1
f3aa20316791a146053906cc989e40a153e86bfd

SHA256
8ec6fb5891a05521ca90951a0678868c2dcbb395eaee9a8ddf00a5d29df4d67e

SHA512
85b147fe6cc73c54cec79ebc1ab0eb6c60ffad1401aa9650ed7aeb6ec12851b73c892b7c487cc00e49392498a11b578e2850732f8686f003f58706bdae558326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
71711abd18954206a94b71e656a73594

SHA1
74a544a2dd9ef313680c93bf249cac7adf97f6de

SHA256
22ce2e7dbf2bf7aa4e18d962d50a7a3c0038f4882d22a2fcbdd90773c2b5b53e

SHA512
13d2c89b2c601cb970f9d2a2d0ea743557e71c58158c3c221df1c526272918b61631d63e96b176cbdb87dd237529e7a42883456c49c2905c3dda4362da384432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1593c61114c2a85893796627dd974aae

SHA1
407c54a3e4d5d678b961643945ec186940f89f61

SHA256
88748f1a1b6ae88b4cd7c988fd73b74aafff8adf8ffa654da69554cb284ee227

SHA512
ddfb4d2c8f7c20e47ce51ea842fe3b8e0e63c6c1c264a83717babbb997cc62a9514864500ea1bd768cdc51a9b0641efa70cd7fa39a00c484d6e27d90c48b3f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
48cc338f69590cad7213ccfb71ce19ce

SHA1
5b5d397c30d3c092a02839c07d9a625c54bb56e5

SHA256
1594dc16126fce31be7b4eb5a7cdbe25fe5777918109a3362464bd5e135c3aca

SHA512
ffb37978da5e32dbb79d7e5a699c2a029fdc17dded4dac1bd1cdf168ceb629922b274457e446be23c1859e9bccd91ecde1107f89c7082f9f0a30f3a64bc19b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58410b.TMP

Filesize
538B

MD5
8952a9ef39399c9711cf313087624408

SHA1
7f64b99e55b8c1612f75a3ef754f807def12e1d6

SHA256
75e7bc7a1647d1662646d868134be09b3e1a4c2d7aa5c5b3cedbf30d5e1b8e59

SHA512
2e5faea7aa35cd92fefb42a403c60634b20b478c6647f13e127604161153ec7922c46d9fb5f79c528cb65a6e70cfd2a7614615daaab2963e98ebc1d2c4c595fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f663290daa111a34c9e1f1e213e2cc8f

SHA1
160ada941a0b4a0df85f083311dbbb8298f12585

SHA256
f05a23159801f8b5a8dfffeffa5294d713c21eb069e81892117a57981f329bfa

SHA512
ea53f8cd8d36b2b3047a981822b997b688fc2c4e12ad84896eb48b6b2a7a36b1ec2ddf86373156f049ac16c98e9621c5773db2da844cb0e074d84e8e56260a2e

Download Submit