de315afddf65e5f236d4d0c028c65a5914fa8d6a74f19b9a804fda7689570434

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a2e08e8376763b921f5cd347db19a45.exe
Size

192KB
MD5

8a2e08e8376763b921f5cd347db19a45
SHA1

73986ccc4e2859d4d278a6d96011bdac8c2d623e
SHA256

de315afddf65e5f236d4d0c028c65a5914fa8d6a74f19b9a804fda7689570434
SHA512

620a085c620f7c08a19100d70a0ede3fc6658fa409d944b0287614c02c171e8704eb51942331d67df4e989a399f20a9752aae2a90e94cc1f9b240e407581ac31
SSDEEP

3072:8wYwJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1Jl8e8h3:8ZzAmmI0k7vVe0E0YIM1f

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
1300	msedge.exe
1300	msedge.exe
2660	identity_helper.exe
2660	identity_helper.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1300	1512	8a2e08e8376763b921f5cd347db19a45.exe	94
PID 1512 wrote to memory of 1300	1512	8a2e08e8376763b921f5cd347db19a45.exe	94
PID 1300 wrote to memory of 5052	1300	msedge.exe	95
PID 1300 wrote to memory of 5052	1300	msedge.exe	95
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 932	1300	msedge.exe	97
PID 1300 wrote to memory of 744	1300	msedge.exe	98
PID 1300 wrote to memory of 744	1300	msedge.exe	98
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99
PID 1300 wrote to memory of 1068	1300	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\8a2e08e8376763b921f5cd347db19a45.exe
"C:\Users\Admin\AppData\Local\Temp\8a2e08e8376763b921f5cd347db19a45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8a2e08e8376763b921f5cd347db19a45.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe743746f8,0x7ffe74374708,0x7ffe74374718
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17005177427213438720,767552403267692168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8a2e08e8376763b921f5cd347db19a45.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe743746f8,0x7ffe74374708,0x7ffe74374718
    3⤵
    PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
f44baa30f040964fcc5ed527741a0aa1

SHA1
8999e13a0923e3e8531b5df0954771f7a1a3fa33

SHA256
f52adc5ec1e7bdbaf71bff8caaddbfb497ae81357a228b964dd3c597e01aea38

SHA512
de713d98f0c9f725efd51cb00b817eed06f4bd1d6cc789a275d1196c228ee03308dfd1aa5cf8da8619ca52f47cecb4edcad12f00cf6a759b191bf0d0164fd2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c9f5f37eaa8512b5ca6b97de43ef7a5

SHA1
c2e0973e3bbfa3b86aa4607ec13eaa65f5f30245

SHA256
e00ee0ecf52aaf3a164d0079dccbe56788df2da9f25953cce50d58f3ddfacc86

SHA512
a663dbd1753f3d875922e2e38d0f6dbef8e56ebaf45a2ff6d4dc56403db3e0220cfc1c85824fdacd3cfcb1312b0c7b452643cd6b6ae3f6768b69628c5b2aedc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef585955dda090fb5629b6027038bcfc

SHA1
9eb40327d51164ca03365237d7f50d65d95d3c81

SHA256
9b90da63bdcc9d2d4c2b2f6f73de2164f4e75ba9a75c7f6232a51c1e78101461

SHA512
70f7113ce51f343b0358311601b400c0b659133f14570dfaa7d82df0187ae9f0c11d68e55ee1bcb947f93728ca06bcd7b87a95cd5e16dd68dbfdd3fc5082cc81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79cf58465e0ed34542ab0924c79e2d53

SHA1
45a75e4d4b13df0e1c76df8458d768cf551188be

SHA256
96f595ec82bf70183498d6142b18bc7f90ef509cc8d2d43301a6281fc43e4c19

SHA512
362a3291420a4b144ad12d362dedcdd8e4cafeceeb4d917695141c8c85c4f189734d7aa947bc4670d95535fd26eeada0e19c4b8c3bb8a215a57fc408611d6f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8582e3b26ae33098cecb745197854114

SHA1
333bfc1a345e7668a7c83c7d68d92eae3fcfebfc

SHA256
65e0d5715d45802bf4c973be5d98915c2ac81c074c6e81ac9192f1fc5d73f624

SHA512
f9e18c6c48e746938fc0ffc3dcd5c3670267f15cf9039d806ad05a02bb234ed92988874986729a5380051f9cf8093102ed12cef78b4608bf4c0ef108021ef871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809cf.TMP

Filesize
371B

MD5
4ce235db4f403aed8175c449350d4d32

SHA1
b6a068405bad73a273323fbc2216e470726e0f14

SHA256
5b8ab707526c17a57cf6d4f8bb5ba2d9fd2e2d934a1192c97c6c4d9cfe99c7f6

SHA512
b69f1781132c20affa1899347fdd23d3c7e20b8533edab04b4ebea8b2ddadd46a7dfab007a7007c5fa91515a4206156333219bcabb4bc9cee6760b06341ddd94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5dd4505102f2a9f5adc93f896af43741

SHA1
f35b73432d14d6ca41c1879045ee00f9e7e3488b

SHA256
35c0ed1d1906d5e1c4581d9c3b3e9c9d0581d1f8d1f143ed42e208e62f4e6948

SHA512
9a7dc0417f0dc2b8229db3493530430979232221ff741518d2669976ed3087293fc7fef90b512e38892f69482fcd1c20c7eb034bb41ddb3baeed778888f8568a

Download Submit