8417702715c498fd1e95982201181aa1cdc65b7ba6add6958ad72ce113b3a5cd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2896-215-0x0000000002050000-0x0000000002080000-memory.exe
Size

192KB
MD5

01764e1b731834f9aad32ca7ca759338
SHA1

c76366420b618b2e58cf1152514951d5989c0360
SHA256

8417702715c498fd1e95982201181aa1cdc65b7ba6add6958ad72ce113b3a5cd
SHA512

1912bb29352fb47aa6f2e7985b4c11e8e93a015028f3b0b0e1aa030d0062e85d07cebbe9a1c768b769159ea0ec8b19f80d069d76a26fc4bd0a7c0943ccc683e9
SSDEEP

3072:8wVwJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1J18e8h3:8QzAmmI0k7vVe0E0YIM13

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
408	msedge.exe
408	msedge.exe
1736	identity_helper.exe
1736	identity_helper.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 408	2584	2896-215-0x0000000002050000-0x0000000002080000-memory.exe	83
PID 2584 wrote to memory of 408	2584	2896-215-0x0000000002050000-0x0000000002080000-memory.exe	83
PID 408 wrote to memory of 4444	408	msedge.exe	84
PID 408 wrote to memory of 4444	408	msedge.exe	84
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 2772	408	msedge.exe	86
PID 408 wrote to memory of 704	408	msedge.exe	85
PID 408 wrote to memory of 704	408	msedge.exe	85
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87
PID 408 wrote to memory of 1428	408	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\2896-215-0x0000000002050000-0x0000000002080000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2896-215-0x0000000002050000-0x0000000002080000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2896-215-0x0000000002050000-0x0000000002080000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffe12f246f8,0x7ffe12f24708,0x7ffe12f24718
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10043868024943955107,10049559100329055340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5836 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2896-215-0x0000000002050000-0x0000000002080000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe12f246f8,0x7ffe12f24708,0x7ffe12f24718
    3⤵
    PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
6c1e0f72c2c54f6952a8526a8bfde038

SHA1
506d9bec503dc55542c87342e0ddf678ea4c3918

SHA256
38b8c2ff6fe1bdd00b0005f9318b7248d16d7756dcc5e967adc5af919b1f57ec

SHA512
3c1da74e15c20a1a3e0fe77984422f377ed6337095b411c7ea2a9bb6e001d7f01ff8f325d3e0d6af0b70c2e9ff23b7a0668e3d99b5bf7bad8e2a4cca13316863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
debb0d28836842dd8557dc8d31b0cbf8

SHA1
40c8d5eeafac4e5789f1340602cd10700d7b534d

SHA256
0d0cc3406f3133baadcfced19c7259185b058e9eff52a69bef3c22b035e49057

SHA512
42ebaff351d6b79691c14a41f8a9af0c2df3e10571b85d46bb69112f93c2fd0e75a179571d1901f30a9cfe1253af6db0b833d204a10a95da24d8a051548186bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cdd0f14dbe97ac5e5a9f29dd122c298c

SHA1
434aaddcfdb78bd2a8e5789a44337fdfd977a254

SHA256
e85437b5b2cd9db778788f7540e061c9af802b166da2c07625ad5970d65b8c34

SHA512
5f1e39da0019daaa911ee838ec3b14bf218162625e0875ea44df36cf239ab91a74f1e7bcc39a734e9823ecb1ba75efe775e10bcaf00ee933756888e1b3b5e8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0c930040c8b7895686029a6e71a71372

SHA1
a07b7abb72f43ba3f94bc79515a114988cae44db

SHA256
f56f2dc7b747ae636d6f77fe2fe107d691aaa72d6ca7df95cc7cb269b9768dd0

SHA512
cdca7c83d9f2d2a58d24e6598b4a7dab394a30e8a50432bb365258735a41451d05bd44d9cc81e8bd07cccb4040ceac9a747c4414997f9d493f311b17ac271fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587b36.TMP

Filesize
371B

MD5
c3289480a4177bd5ad008c11cfd17548

SHA1
92ec09c2de38f5046868481280f3e4ffa68b6ac5

SHA256
aab135797e0399e9cd4db2a96342d58d343770a0be006b215625bfe849439363

SHA512
b2e8aa362333333962febeff42f94d291770beed1b9a9973f1a9ad41c154c4c41d150297dba32d9d422c708402e5a6f116f58cb916bf568c2c0f1ca15bcfff26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
65b05738b8fa1b80b40093c8b52d321f

SHA1
12e1fbe9914bd51eb5ec994291be4815aa219118

SHA256
aee2ee99bab735b73cee4de3b02889ce95aef9ca20cebb87728f05d44307a1d9

SHA512
2a3f93b7ab38e199e9bd174376d49e6a079783bbe91ac884faecb2fe6c473835c4574521b095d890ac183d3bc0aeeb62781e38988a42d1d555b6f93918e2bcc9

Download Submit