hxxp://www[.]arvinas[.]com/

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.arvinas.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4952	msedge.exe
4952	msedge.exe
2488	identity_helper.exe
2488	identity_helper.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 700	4952	msedge.exe	40
PID 4952 wrote to memory of 700	4952	msedge.exe	40
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 2312	4952	msedge.exe	87
PID 4952 wrote to memory of 4208	4952	msedge.exe	88
PID 4952 wrote to memory of 4208	4952	msedge.exe	88
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89
PID 4952 wrote to memory of 3024	4952	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.arvinas.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bef946f8,0x7ff8bef94708,0x7ff8bef94718
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,15777250929157254794,3467819068282205917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x424
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
915181f8ed6effd1e63b39d914586834

SHA1
dd1b5e9b10e22f029f24c8dc6f2e05e0794f14e0

SHA256
0244853d014dac95cdd453691e0703aa20c587cca1f7e31070488c132f87cd4f

SHA512
b838ea5042b14c4c35f61577cf260ea6060ba0bea187a08112c0dc5ff4f22880c67ed7db78850725a30b27e7fee3694b3ca9732b0b872873f07bce8b58a946d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
976bdc765ab3b6f0377fa5fd49d716c4

SHA1
691f5f2811c1069b675d2216e08afe2bc045af05

SHA256
222f25d7026ffe4509efd583e86af22544af9e7bbfabfc745fc0c943e0f033c9

SHA512
b0901ecbed3af4731d246f124367a2d59a167dc9afae19c87adabd353d7bd7887236aeda12c9a39db3c4fde878cc6ce4cc30e2fbc74a66301fd1cd377c1481bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3639e10ffc660c93d29a935ec29378ae

SHA1
91735a97de191155ec33617f2c4d0fe56ca03338

SHA256
ac2b7c45bf3c1e94db411dcbdf00fcfd1f1ba8b9351c3a9a1910806c6e656b40

SHA512
f5c7becc7eb8dc1f2ff91fd076a3219196c25ae7617ccc4ae9f54113bde8bba265355215b13eb8a7a94263582eba3100be0535fef0eb8dfb317044ebd410ca7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b4dfb2c26bace309a57ad54ca446bdbf

SHA1
4aeef1c6669bf215839fbe0ca359b04a9feba20e

SHA256
645d75d0d856e5d96c7f476700517cca5f0a79047529b2d014ac57aa30e4a478

SHA512
caaa1e9bda1bf4b78ebaac79c24fd2dc77121e4b9f57d08b0f75af0e4e091217aaad9ad9001b9a28364220bcba89308be95c0b89c486819ce3311af0f4c47cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b6cea5f200ca5e4fd9bca416a73f539

SHA1
89157a676c4a95f68121dd4c665236f1b509602a

SHA256
e0dc8866cd24bd5e1eca3d29caf35073beddf4257a42384383662d6bbe7d0eb1

SHA512
fa70112827cc5294b32477eca0eb35d648e50cb6d33ef52bdc2a00f4b1c909e1c1483545eb80bad2f7b4144dec92ed4fa9be33ef5b9df627ff2d07ee80f745c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b197d40a335d726b80875a59e55d0404

SHA1
bfd12f0fab28778fa0445f29a939cd4c63a08f59

SHA256
e7c10ccc7df73424f141c59ab757921b48e770445258049657abd1f36a001b62

SHA512
d06ac861eaba478d076ef66b514738d4f07a782798238b759ab0447478db2c6fdc71844f62abcea6ca128aab78fcd9acaf25faeb790af368245e45f79c2f3535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2400de50c6d15701cf8fbb99accd9cb6

SHA1
efb7dbead7583ff7db77385d843c40121a9aa09b

SHA256
528c0890c09af488427a9882fc96ea0fab89f4af51b150a127ca6fd3fa7ef5c0

SHA512
1d26a2aa6739a7fb1d2a0d4b36ba9afd89fa5927befbb5d734ee6821e40e51d824af4da95886f7b5d99d2e31c6c7cafc6959f1b33a1253dd0e72fec8b16ce78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4a239cbedbd75e9efcd1837c028229e5

SHA1
4a86557c3ca846c4b5c349c348e8f29e92fa0ebf

SHA256
2f432537afaf5f95b3fa4ee8b0de3f502aa38470697d80e8d1e4ad63f0481bae

SHA512
468ffdc871cdf6c823706b70883c0e6b69cda7ded0a53937c48fb9a2b35bd6d1d112ce97bfdccc917973403fad6994f67ceeed968288b2a31b8cfba4bf902692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2c0e61ec7ea5e7aa659921932b6c1e86

SHA1
ad11dbddd8fbf8ee755053a40549e2610f8aced6

SHA256
9d5302adb74c499307da6be8fbaa2b42755052d8e2d1d8db7e4acdaf8aef76a1

SHA512
965eac5e0e864108a2f38745a9e501f084bbb578a193d5df1c60c4b408eae5dd57c83ac716e8b84744e9a703fe257d2cd6dcff53ffc68769cdd90c32205a435e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ed78.TMP

Filesize
1KB

MD5
ad9d27dff353ef418db2ded3b91ed1e2

SHA1
f91fb6abc1c95cacd6382234a759108cde978c9b

SHA256
edbd84cb08ed2e011cf09a84de1f2a3f163b6b8f9860c7a7025a516c0d2fb535

SHA512
711251b075182db21c461873c7ccd217424ecb45f87542598c0832a3f3fa9032e3754ccc3a35faa36fc37a993e108c9f92a66c165690f046d0199102be8d8a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
420e671fb446a3969ff1ee356c89a261

SHA1
e8c31ffcad1b44dcde72cf6ebafbb59695f7ff47

SHA256
88fb10e0bfbd0f3b20dc10a851a86cd77ad81f142ee829e38c7e38b203ee241d

SHA512
6c437e80eb9b8a128ce4de80fdbd799116ff93337f097e02edb3fba9fa96ca5c30563c0a0882e55fead536ce881696f865788935121ef63b61bb6ab0237ce021

Download Submit