hxxps://mccroryconstructionllc-my[.]sharepoint[.]com/[:]b[:]/g/personal/fturner_mccroryconstruction_com/EcI2kKqS0WVNpN-mS0beOEABuA6mpoW5ESmjJ9UTrJsDlQ?e=4%3afMIDla&at=9

Analysis

max time kernel
197s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mccroryconstructionllc-my.sharepoint.com/:b:/g/personal/fturner_mccroryconstruction_com/EcI2kKqS0WVNpN-mS0beOEABuA6mpoW5ESmjJ9UTrJsDlQ?e=4%3afMIDla&at=9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
3708	msedge.exe
3708	msedge.exe
892	identity_helper.exe
892	identity_helper.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4700	3708	msedge.exe	87
PID 3708 wrote to memory of 4700	3708	msedge.exe	87
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 2444	3708	msedge.exe	89
PID 3708 wrote to memory of 4848	3708	msedge.exe	90
PID 3708 wrote to memory of 4848	3708	msedge.exe	90
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91
PID 3708 wrote to memory of 2744	3708	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mccroryconstructionllc-my.sharepoint.com/:b:/g/personal/fturner_mccroryconstruction_com/EcI2kKqS0WVNpN-mS0beOEABuA6mpoW5ESmjJ9UTrJsDlQ?e=4%3afMIDla&at=9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2afc46f8,0x7ffe2afc4708,0x7ffe2afc4718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1368 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11627331030383671928,3434242098215429035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
30KB

MD5
d6b30746f855b6437cfe2cc9ef1487ea

SHA1
3c85cfb3aa6d2bb9b32e36a2bb54d90f3599e454

SHA256
cc0808cff36a2fce0633987b0e54184bd50d0dd1aee80f42bbd7113cd17f6c56

SHA512
389d45a43879b716dce28c9014363077afee3b27c883167aaee0a00c6159b94d6f29f0ca36a6991036ca0066f88064da4474fb0e82b2c3f2ae391d577596fd9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ec3622f34a5d9e9d5e53df7338477b6e

SHA1
69efc1d4677d77be1554413ee3500f6aa57644a9

SHA256
c6148c6b1214d26a3865cae07a7c071ba35aeb47f4b245a8a496f1b02f142234

SHA512
95bbea73323fdba050e3019e6472df9a021397705ac9db3745e3777675f55bb1f6651273f12de4c90b792be1a614fc0b4ba3b385c2789ce71c19016476a95729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
7a4b4218d7fd84094d8609b6b1afe906

SHA1
11d4d41682cf65a4660818a4e9e539dd45341ea2

SHA256
ddaf6d1a8a37a7efed608d4b330ab0872b0e9289c49f05364fc7c59ba411f47a

SHA512
5cb0c0e296a82918522ea4125b2fae1dd0da45a6d6e35315120b3f4484d9ffd99f949ba642ac0d96cd741cf3a7b0e5cd30457088870ad8d24ef806e010b2bb32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
374B

MD5
fc541ff6f095114aa00ae3f079d5e01d

SHA1
18bd762ee81a4984582c61fcce393b52fd3af272

SHA256
bff39b29f0563faa75adb00d1712e578708958fbf0e4792d52417c3abadfe048

SHA512
0a7222e75bcf979ef70ccd337472ff4c326620360de5e3ea17e5d198f33c443aca21bdd20b8ead4dce93ebd4791b83938eea1568b5f879fd2c7221521751e3e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f35b4b2d20b0704a1ff18927c213f673

SHA1
72101fb146fc98e47889d6ce91d1fbc7e113cf2d

SHA256
8e6f519ed9a7eedb4de005008b0712d7320d63bc6c083381e567b523eaff8a91

SHA512
7ca0ab900b723e3a19a1e3d3b46ff53f3f2a7160c31285679280a0f7689fd4d556983e5f13dd7875cea1824d8385c82505c0f05978270a5be4588c37e74c3483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd16dee56a6faa6d53e3bd1dba705c73

SHA1
1f23fbc63d99ede2062000c90bf7c9781a4088d2

SHA256
9a1661c696d084a026f9fe3402b5294078cb15418c1d28ff08b87c2dd31d2d0a

SHA512
70ec198238774d67f7b7daa4848cb566b86ff772299bea823d7b872e617b93d5f3c3d5c7eedd0a93dcb331de8fedf479fef49cd55bdfd7c1a4bb0715dc99942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdfe889e319148d5b0ea69da3a7fc423

SHA1
a52c46f3f10b50ca944464e157c820f036874bce

SHA256
e230870e943cee92f17c8b70fa7f24ad8df172d2e56a6f031d43de3a7ac840df

SHA512
e61a42a1d5e9cfb9572736d20819323e72282d40e3fee25eb50ab3867ab897284d01c74e17dfd07e1a057200d908dd00f41da858f5c3031599d88584abe7662f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db64e05c16f907d0150d5c89e5ff3821

SHA1
00b17157a47b803d5806fa46fe1b8ca11f1b6b29

SHA256
74dfb09e6e211ba56d7612e194e34367162dc16a534f0b14cd5bf672e0964adf

SHA512
3d0712a66517034b5026b7129c3efd5010cf78e2deaa961827eeab348ed684dd9cfcf0dbba115fa7b52f2270d65be4438c947bbc10d1ce7069c01d1c8865f286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c78f839034ec283d74ef25b4bbf569fd

SHA1
2accefd253289fdcc5392f85fe78be3eb69141b2

SHA256
e80075f4f245cb13684b8c13acd66423095f998ecbdecd1f0cc4f6dacc3bae20

SHA512
33a0ba0e8ca8a8387cb4c76c04918926e34f167bda264e295ab44d1a55643df57368f6115d08e1c40369d574b817b4969018cba0da94a685cc0074333849090f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99b905ac82714b1113edccda3ebb629f

SHA1
a039681b19442317556be4e46762d95b38654166

SHA256
8ae44fee937d913bcf75792b87b16a61fe9bdc3cac466ce79026c6a218cc0125

SHA512
5c24cba48ce1e1ab8452fbff07c408ac349487d7730f47c91153db4c59ae8be9acd095e4f6452d8a2e5f532ac17f6bb78a9cc5821bdc4a02b7216454df0ff6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e5f5867d577b56b88f89e2a2921a5f34

SHA1
15fb77ea7bbebb496f922d2b27806679a78e5dcf

SHA256
45f6c773962a83edfa2493e7a8b33bf802fa7e308edc143621de15e6b66ab73a

SHA512
6e1a67afcb6d26525a8eee670ff2d5f8f161e4f8381d587cd5f8ee99b51e47f23a552a59417c29b81a37318e0e82d21bb1b12e3c66263f39fdb8cf98e0abd257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594c13.TMP

Filesize
371B

MD5
1f6abc7db8e678a0766203c2a57bc802

SHA1
aa63ebff936c65fe49260cba731a60dfca3a3f7c

SHA256
6eaf79d483e9a3f75fa28ec8f19ee0fd7ad256263d656680b5bf2bd5f84f16a3

SHA512
83acdd8b0d0e87f8c0ee6b1cdc3afce587de74b2d0db83c9aef4571c665ba1c607c1bf5a2c74700b084d8c4c2918eeace14fa0c44b2523a7297330c7535dc673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b7eaaa7ee78c04e62f1b783cf97e023a

SHA1
d37ac5efb8ba3c24e923b48d4e8f06344ee6f44e

SHA256
f1f0d274a907e961d5d3a7f9751cc576924368dc2fe5c4a318b212dc75f2b394

SHA512
08e8cf11b97080dc5b5a9026444daebc1e0b0e40e3202f218bd0b9c2da72499453165e0013982dfe607432b89a7c8d3f9371a19b3ed7d15de48031545dddbca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70b03feddd78832c51d3188b0beb0af7

SHA1
b269f96add9fa2a8f513da0e68100a5b18a950b1

SHA256
0efbd0a0d9c2273e8037408a56eab24311ef8ee28c0747e70cd7db56a0a604d2

SHA512
e010ace231286ef18a95b018cdd5fff7570e0c79db9b38a19fc6ab11a85ed9fbc88b5d036b021a4ecdb5a98ecf56215dfda156d04ed5480e7d482c0acd27a346

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit