a241a18561e9c3e4c286e095153a23435b073c2b4a3126377c2cea5b54578105

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2023, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1992-54-0x0000000000230000-0x0000000000260000-memory.exe
Size

192KB
MD5

61899c7dd2860068b4602bf1e94ae75f
SHA1

b8feb441cd8a4e4466781c8a59ee699086bc62f3
SHA256

a241a18561e9c3e4c286e095153a23435b073c2b4a3126377c2cea5b54578105
SHA512

d0d6f4230be01a28bc037cb753735afacb5590ea9557b7dd67008094e37f827c402010ab6ae3579f13c93f587e804d4dac54971c56c5efe8ca38f6d72171d0b8
SSDEEP

3072:z00h3GyCdI05GPbvOXbaFai9OfeEZBE0OhRcR0feJF8e8hK:FhUdI05GPbsiCBE06I0fef

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
3732	msedge.exe
3732	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3732	2956	1992-54-0x0000000000230000-0x0000000000260000-memory.exe	86
PID 2956 wrote to memory of 3732	2956	1992-54-0x0000000000230000-0x0000000000260000-memory.exe	86
PID 3732 wrote to memory of 1508	3732	msedge.exe	87
PID 3732 wrote to memory of 1508	3732	msedge.exe	87
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 4144	3732	msedge.exe	88
PID 3732 wrote to memory of 5068	3732	msedge.exe	89
PID 3732 wrote to memory of 5068	3732	msedge.exe	89
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90
PID 3732 wrote to memory of 2988	3732	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\1992-54-0x0000000000230000-0x0000000000260000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1992-54-0x0000000000230000-0x0000000000260000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1992-54-0x0000000000230000-0x0000000000260000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcadc946f8,0x7ffcadc94708,0x7ffcadc94718
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4563179075805051287,5297051109383733769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2608 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1992-54-0x0000000000230000-0x0000000000260000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcadc946f8,0x7ffcadc94708,0x7ffcadc94718
    3⤵
    PID:32

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
01a041b1ad0fb5f627abe7f8ddcb4b34

SHA1
639d8bddc4508996e01a3430e4bb834799927337

SHA256
11fd4a59bc03d5d93fa7979d4edf375dd7718e57cd617d696dce3005e0c4ef08

SHA512
445ecba2f89176472d55fa9d75ab6a6845680506d76d85343fd122815a9a5d90d60ee3cf3091517362ed0ea6719f2348a4a0f39bb9120732863f26156a869c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
366201c8e6db2667877410ae82f7577c

SHA1
629eaff8406182c372b58144b51898a64b50cd09

SHA256
ba06c32ce9ffc8091aa2aa2c3f5538e7e0554cb3d62ee4f0cf697ac91e30efa9

SHA512
959a32b847109578a546a2b8cd9505be20820607fde5312e73286123b48a5d04113305c5a858568a8c4942b588115f7e7f380b56a2fd4b446926f38405a2468b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf722e467399645a7ab6eb3143bcd5ad

SHA1
f4f1fb8a2fde885e0ceb68e3997296e08aee5158

SHA256
b14ffb5549c965e8ca83ac9dcc09e4e6c4d8da57cd87b32d8ca39255d1e27e24

SHA512
dde8109f61496ffd05a23d87a12618a6fe482820137be1749d72ea51d6a9503e537dd3661ef8fba00f1c6d263b24b4c024a1a2b3afe30d0080b863841e272f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ad577a66884e4f6d528bec87fc576a5a

SHA1
e4c3cd932fe02a5a4172f2cff1512eed07cead66

SHA256
e12ba97d9fc2c35d6b0123a080f9d3fb0dd123161377c5e811b02d6502901bee

SHA512
d29c6a4a675fbd0351c1f77eb3f62c635945f1139d52b788a6420caed1bd2e35c5b0709e375cf4fa3052533ba009b039471b01cc176e004b9e5271588c8710d8

Download Submit