06214377f5468efb1febb428e1da609372841cb440cba21a23f37de4b4085b44

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3812-31-0x0000000000580000-0x00000000005B0000-memory.exe
Size

192KB
MD5

53231c065700eda83c866fb9a8946b65
SHA1

d0c0e3c59142818c1b066cfed193ba419f484c55
SHA256

06214377f5468efb1febb428e1da609372841cb440cba21a23f37de4b4085b44
SHA512

bf63427179121a1c3b5cd649147a2ab9fbead07b7b3baf0e670362a0b981c33aa2d99ab2efbf23a22e4b5ff84422d73435295a8100c6c819c649e2268b8a6df0
SSDEEP

3072:8wvwJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1Js8e8h3:8OzAmmI0k7vVe0E0YIM1a

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
1688	msedge.exe
1688	msedge.exe
1512	identity_helper.exe
1512	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1688	5088	3812-31-0x0000000000580000-0x00000000005B0000-memory.exe	88
PID 5088 wrote to memory of 1688	5088	3812-31-0x0000000000580000-0x00000000005B0000-memory.exe	88
PID 1688 wrote to memory of 4076	1688	msedge.exe	89
PID 1688 wrote to memory of 4076	1688	msedge.exe	89
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3372	1688	msedge.exe	90
PID 1688 wrote to memory of 3928	1688	msedge.exe	91
PID 1688 wrote to memory of 3928	1688	msedge.exe	91
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92
PID 1688 wrote to memory of 1816	1688	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\3812-31-0x0000000000580000-0x00000000005B0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3812-31-0x0000000000580000-0x00000000005B0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3812-31-0x0000000000580000-0x00000000005B0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9313346f8,0x7ff931334708,0x7ff931334718
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4695844314895798840,259182667033754599,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
    3⤵
    PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3812-31-0x0000000000580000-0x00000000005B0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9313346f8,0x7ff931334708,0x7ff931334718
    3⤵
    PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
b2a2a2532443897c3d145ca764fa40b4

SHA1
a7c131f0fad5ef262d3be58730310689177d4ec3

SHA256
53396e1bd36df05ee1c9c25f897c492235beb3d50da5d9a596cd4f53e52e6a2e

SHA512
ae4fc2dfaa1a92a6263c431b0425622f4dc27ef0e7685458a2a63d7e13e094253c810ca2baf2af57f3a6699d5be15f7b07458cd60c077a65be313b4cc89b1678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e496bb71efc5a2678abf16fc5421a0f

SHA1
ebc2d68195c1e1ee9c70f22b2c4ec90ef655ea92

SHA256
9075493c218ce460da05a69471f7707532fe3c930e49509d77ef6416419e64f4

SHA512
e0b08da3c78d87d60dc5c611a84de6e40fab75acde48cea2be01f90318e1475baa3ce10d4c03741720c888067ee4b893ed25fadfc03a0264961176bafd1d612d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bccbe2a3fa9ae9fb97bcf3a662a1b159

SHA1
2cd3c5bd7ee9aa32d2e09f689c0502bd8ce8494d

SHA256
0b547fffb198c3d9fa997837336752a1a8ec94d87bdb843fa609d20d146e2c92

SHA512
59dec5d071dc4600a5a89184ccdeb18899816522c5ae2cc646e5979db3ad8595cbd5f2b6146f89a4c5d190062f2cd72afcfd5b2725c9a7fa807f739a59cfb861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fe6b2e7f7e94c8bedf85b7403064675

SHA1
5fee3fafddfc7522d217a0fa944e969bafbce801

SHA256
7f9ac4822c2a0254c6832159214eb88ce62e82b0ba8419f60523ea621cd071b2

SHA512
edd8a2ce691eaabd1c2090957972c7b6ced2c547a02d1e86d503b037d7231093b7899feafc1e6bdd0b1108e21d91f4b288222c2e10bb8bd11372837b7779963d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
5db164f16ee343bc1201996e5f9ff75e

SHA1
36d20853d67da2c73227a3251520a7a21f3a2f10

SHA256
2156f5e0f50f3598412f56010b67ccbdf9b90e59fea0d603dbd671e77eae6812

SHA512
3c2e5faa04e74ad248e8307b0fd75d3abc50b1bf73f65f3d660b019990459b8a915b2562d389db715c77b0cbefff887eecc902606627f52af12f7de22ee8d018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e30d.TMP

Filesize
371B

MD5
6d51eaee670ce2e8e0c67bcd6863f7bd

SHA1
c5949bcdbe8ae69b7769e4799d217c8e66923ee0

SHA256
b8424fe8a658a51c74a84747db605a1b682ca7a0beec807719dab0baa8b46cdb

SHA512
e91228b80142900f6bd7eab7bd179eb708d0814c2e0edcb633ab421f3517d2ae035af49974e938f1fcc281d17df4ee29760fb0d8683d24133321296498e5f1db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50ae6ad61ade36917afd7b8384228b2a

SHA1
175d2061b2ea1499176f1168b7803867f7c01fb0

SHA256
3c4be03da2e1c8f5e5fe1505bc36fe4c0d3aec1dd03490b9eb0f0de72638e806

SHA512
23c330bdd30c1dc6adfe229d37a5ea192685bb608600050b445ec154e6f151b875c8ad63d7f76b7e2451cd60f7f518a4233197c6f2f05a821550045087b79451

Download Submit