hxxps://www[.]microsoft[.]com/en-ms/p/minecraft-for-windows/9nblggh2jhxj?activetab=pivot[:]overviewtab

Analysis

max time kernel
1701s
max time network
1715s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.microsoft.com/en-ms/p/minecraft-for-windows/9nblggh2jhxj?activetab=pivot:overviewtab

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
3944	identity_helper.exe
3944	identity_helper.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 4996	752	msedge.exe	87
PID 752 wrote to memory of 4996	752	msedge.exe	87
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 1444	752	msedge.exe	90
PID 752 wrote to memory of 3444	752	msedge.exe	89
PID 752 wrote to memory of 3444	752	msedge.exe	89
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91
PID 752 wrote to memory of 3824	752	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.microsoft.com/en-ms/p/minecraft-for-windows/9nblggh2jhxj?activetab=pivot:overviewtab
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd82746f8,0x7ffdd8274708,0x7ffdd8274718
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,12899402673147306801,8022784923535478608,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x494
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
ec49257fb7673eb51931908214ee8677

SHA1
595a1a33da46e46dd05127d97ced48f08489db63

SHA256
775c3b6576e4ca0af45f67a1ba6f5cfab059c2d084a668e9af937abde82ff9f0

SHA512
bb32cd09bfc55183f0ead041f9f3138aaca3cdaa405607ab1097b548bf9825c0e84061e4329bd096548cf33ead00d1e18e6076943230be66c945e318d79e3758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
517e1a27bb2ee4b85cc63f2ed42a1b12

SHA1
2f0d8bfee01b39d168031bfbbc8a15f990b8b3d7

SHA256
dd6df8d9744ef6b3833cf314691759c5e30bdbddb4dc31d8e06563d5c66ab045

SHA512
8e955e16eefe60aef75c098b911a85fcdbfa0522c7a39a41689346c03e9b5a39d24d8be155da1d78c5f69711d5e9898c0e6dbfcc1740eec8453b28a156f5e450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
188d1cb17c6f1b6c2cb0474f731bb29a

SHA1
77dd52059dc6bd72607201cf3c4135e3b78dc4dc

SHA256
7a21c504fcae0491fa8b6e8552257ef3229fabb9b532a1f3b34b0d97e5c6831f

SHA512
abdeb87d74761afa24a9423e7cea097f2bf4d98c9e5792c8b5b6ff22e3c46e4c267c295b0b01903e7d2a283c59c09d1c418ecc91be4176387be222b5b410545a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd267a2710980abddd163be329211d04

SHA1
4f32806e494e3580422480055850a749d96ee0c0

SHA256
fcb2a01bad948d8a909bf61a8c5181155c90f77414bed152e94af76c868cecdc

SHA512
f5b712ee267e4cd0f0bebd1afc3343da6e33a38ab7cf4b474fc00e888218c0697309d8ecf66f3626484d7d47f3934c580b1c773df998a83fc0ef748f2bdc7ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
66fbbf917a3d218fd8e49e36daf7f03a

SHA1
8ca5478d048e1ae35ae5ee091bb2a0db12fbf499

SHA256
0bc2d3e7f1300e5bc4dbc8cc05dbfc933c387a0dfde04f202dba2e7bd0b72407

SHA512
74787279763d3a6f3271776366ef78e38a78eacaff3d00629b0c3da8875d5698e3c2dbd5aff11ff1d65785b602aec8c74de82fc49bc9c03f19aa0b0c8965a58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c51f11147810eae738f4a1da72b99662

SHA1
6c4576dda97f01e8c89b5bf014770da2aaf193c8

SHA256
1dcb5ba5e2d840f870d9e7111bfc714454090b558507bb25284a5e41077251b2

SHA512
5f2bf3fde48e65d9cc97ee2a4808af0c03cef2e6cab3aa6244a26986f11d4f447180fa13325a36885be1daafff3f3394a7cac225bc042d7c5bb3f99c91c7ebbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
2f806861eff844bd0e7463b771187287

SHA1
bd6e513db4e0f6a10c5079d1ddbc06584f9740cb

SHA256
383a3d2870dc3c9598ed4765e24fedba07169c652197d90ef0f8b5e2de8d63e2

SHA512
f977435d73b70e21747ba0c94b1c24c27910d8dac45b8727867aa61db19228ff43d1922c1d1b61465cda91275c234ab48c4e6897102dab1e80bf68db8d97bfa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
009389849e2b5626a835e11da50240d5

SHA1
521251a4ca5d74a89c2a3f42b30cbd415876c8b9

SHA256
98af6f314d2ba5ff5a32cd27b9c2905a57a0acc61f4e75586af30adbbfef2034

SHA512
11f78df676bb021452e3c2486475559cda478838ca99704f6fdaa51649cfd4440287b943eb34411ffabcb2741f5747792d92031bc1b23562a9a3a837c532b7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
699B

MD5
7782e1c4c5db0d886150327c57bd6a17

SHA1
6641f07024bee120fa44cb4b417b7510e9bca458

SHA256
4c9a953346b1fc0063dbfd857b2c717c88fb1b342a8177bf67ec4642723b6b10

SHA512
716df4d65782b579f22882125d050a585ee78f3a9404fd43405acf4807dcddc85e510b9ea8244a504bbab3010ec4e00362f8d4653b1901e06ee585cb0d423748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
21ef69957fda3e951b8e086ee86d0a72

SHA1
d7cb4ddc2a4fdbf81e1174b9df62da6bc29d953a

SHA256
06b2f0b91886798d3d24d832429d5ae5e36fa13fec5433b2d37a2c0438cf694d

SHA512
66be118b06ce47b6fcf2b206be488a456ebfe1a26fd4860b17ea687ecb8770e5fa96ad083c0513199a3e30f9f2fd93c26654c7cd56aa67365d3a511bb12b2c0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b24.TMP

Filesize
367B

MD5
22874b1a3dc4b307206b0e2a855de855

SHA1
008009c3b825bc60759ac84d3f6b6772b82597a2

SHA256
b577ad2dd0274526df70b077a8767f561eadd6f45c7830ba42288c753674b789

SHA512
9953a69ef22ceafb20ef74688b84d42b34c6852658e4024ba3492e575820e9d53c8e933fc50fd6854a4190a1b2ed126fac9f8a14bf27014e1f45b78677ec0cf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6adc393bbd57ecc82ed296d57c1153f2

SHA1
b6fb29a287ecbdc898d711962ab5a36d2298e592

SHA256
bd919350d56953fb14d6a3c0094e477b8ef225ba289e685f4fd91c3fdbd17762

SHA512
360fe202effab6c5fb6ab30a1b207711b4edddc562c38e1e209d55b1b94bde66e7a3b17fa3e8716a4d27db0915e713f18cb22be49934a8fe060f39a81794dd16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit