9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4.exe
Size

587KB
MD5

8eb42c79eda8f587b9b517f58650fdc3
SHA1

e75261f134ecf40ba92788a4b4afb31f79768cfd
SHA256

9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4
SHA512

3f74a20df0e1a14472d4400d20dbcda617e5e09777a80a9a9d295df2d1ce4dc06627d9ef60deb1a2ea89e4b71ae3298e64d7d41f57deef5e005ef2cb5272c765
SSDEEP

6144:UWOyAU+2GhNskZEVaJsUH/XJUZA16WXifGT3WsXbWneggzrdtU:Uzr2iNzEisUH/eZSXjTdoyxtU

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
2352	msedge.exe
2352	msedge.exe
3656	identity_helper.exe
3656	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 2352	3768	9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4.exe	93
PID 3768 wrote to memory of 2352	3768	9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4.exe	93
PID 2352 wrote to memory of 4168	2352	msedge.exe	94
PID 2352 wrote to memory of 4168	2352	msedge.exe	94
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 3108	2352	msedge.exe	95
PID 2352 wrote to memory of 4836	2352	msedge.exe	96
PID 2352 wrote to memory of 4836	2352	msedge.exe	96
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97
PID 2352 wrote to memory of 2316	2352	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4.exe
"C:\Users\Admin\AppData\Local\Temp\9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e15246f8,0x7ff8e1524708,0x7ff8e1524718
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15726851929436519909,10419259079557481057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9f5c1ac71fab2da6478ba4b259a38e64970c2062c91423c7796968f85d0003c4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e15246f8,0x7ff8e1524708,0x7ff8e1524718
    3⤵
    PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b2a7b19969237b47a7237c6dde5eb722

SHA1
5dd9b852828da58032b98bb253f187edaa0ad7e2

SHA256
cea7f45d2e88ac82a5d768928590db66713b5a9e0da248467a3921811386d1bb

SHA512
df09db5ec19571cf7065886f20c72c326596de416262bad7962d681eba9d17534c33a6afdfea78fd7c928c50b88b7f2407a98b39338bb24dfc84b8c5f71e4bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efb87c224dca875114229ce30a8a6ce5

SHA1
8c413b5f0004ec5ef8108de8d66c4ff2082c774c

SHA256
eebece9affc9e556c6b5340a68745c8089c5612c3379ab806f23f7b01b4722d1

SHA512
c483bb6999e065717e2124ad6723b6cda8eceac3363468268aae02cfa0c139cb90ed35a098f22c0278105de39c984b0a99d9392ab16ea6fa9e7824444b0689d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7bdc87ad1855c9b9755ae13e8e9fdb8d

SHA1
76ff52f26d59eac11bc495cae8a3719492c3ee4f

SHA256
0b2e09bc64ff23f88b154cf5fc1c78d29cb69a7e010775a4d323d172a15f2b3e

SHA512
3e8481bf767b4c8b8d32e55dfef2079f0b042282a173d0533777ee4aee49a458c3cf5a5212ac09e946936fa7324f7314d34847c47065697dfd690d541433712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9da947d71ff74e9680c0d0d8b389f179

SHA1
15dcf2e0c2208164708afa5eb452f0cc5e6c116d

SHA256
39a7557bccac4befaa6e0dbf61ac9ddc798c4edf2b856179f7a8552c84c46bf4

SHA512
68ab4e6b57e9441e8dec5c53fc4941a47d1619bf5257ec041d157968d95866bee5d6197831185f258948628bcdb3a043170c6a7693f499682e661b846ea108e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
f7d8c2e198ab663aee3de09df538cc49

SHA1
8485f96ec9f9245e0050a8d8caae5dc465d035c5

SHA256
a23d1b399d9f4a5f71766f6aaa5984ee5dc95f3fd2b28a532568f0c5be686f08

SHA512
9e944484993e49249b288990089d09331417e5f80948e8ebd1b89dc6137594b2a12badef75e17445393f57fff317df334a33043a3352052a27dce6a282115f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b105d24eb0d699430a1d427a340f45ca

SHA1
7b65fbdbf9f11dc8f696435bc92c9fe2739a7758

SHA256
76df8dee5393dcfc431c3bee28aba3df7de109af28e5ecd41f8af6ae594ec145

SHA512
ddb382fbc8febf0db5003e52ed0b1755a287003f4b21c6e64e75a988d3f053229163ca2bcd874828ce30be8de5184581cd00820a4efb4b260aaac9ac12bb5047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593389.TMP

Filesize
371B

MD5
7582b137dd9cd27312da4c4f5ddf40bd

SHA1
d6666cfdbdd68b9eff6610496167470115eb36da

SHA256
aafd72a581cc0cec8ea2d57ffffb38aa654765faa037848718d4682a8a6a3d22

SHA512
86f6b4b83c9b52d09dc12427e1a469ba4d47358ff7aaa1acf0d44de425e3c4478ca075aad79b36384063f174bea370b827533ac238dfc9b8709cee7165f72a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2db0459adb8c25d2aa808d6cdd5ca0d7

SHA1
c5e62d480186bb776189ebdbd9de7abc099f3165

SHA256
f0324385f308b128a3ff51234974e4b35a7363141a43b3e13e29301f79493345

SHA512
726f6f846a888faf81e898f82cda80788d4d8101e0a43391f33fb1d2b3260a822f0e04ef6f6a7dd02d100faa7a7c359d180689063f037ee24f9980e22d8dcc50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\efcd5ed1-b969-41e7-97f1-b3023bf64575.tmp

Filesize
10KB

MD5
dfb7657b47f6db781ec7a3122af9e583

SHA1
b05f51bc26296136818dd0c9e3e3535ee3bafb3f

SHA256
7852e3a04dfeea54cb805fe57bfadc56138882240910df5c132e725766930ca9

SHA512
de59e3367236c0d703cb77c8dbb0fed1332b849815f3ac787cd934d0f90c6df337dd1960afbaa82f8c8cccc5ecce53c724745505b3976b5873f66dc2670b1f1f

Download Submit