385a05186e8e12038948b3d0fe79389d235a602f1fdc0a0646872cec0aa02cba

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec8fa207c9e21e181fcb711a7a4f2990.exe
Size

78KB
MD5

ec8fa207c9e21e181fcb711a7a4f2990
SHA1

56027e72a6b4e3db7c7b04b85745a5dc9bf4a32d
SHA256

385a05186e8e12038948b3d0fe79389d235a602f1fdc0a0646872cec0aa02cba
SHA512

744d73e52ae0e6461d8f6f600969ddbfb42771f99c5a6da4b548d8b151863f35ccc16d96e45571acd26594bfd55983449f06502663404bee82396ded4fe972dd
SSDEEP

1536:OCHHM3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt29/a1Sj:OCHs3xSyRxvY3md+dWWZy29/j

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
1580	msedge.exe
1580	msedge.exe
2396	identity_helper.exe
2396	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1580	3132	ec8fa207c9e21e181fcb711a7a4f2990.exe	93
PID 3132 wrote to memory of 1580	3132	ec8fa207c9e21e181fcb711a7a4f2990.exe	93
PID 1580 wrote to memory of 2228	1580	msedge.exe	94
PID 1580 wrote to memory of 2228	1580	msedge.exe	94
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 3636	1580	msedge.exe	97
PID 1580 wrote to memory of 4692	1580	msedge.exe	96
PID 1580 wrote to memory of 4692	1580	msedge.exe	96
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95
PID 1580 wrote to memory of 4344	1580	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\ec8fa207c9e21e181fcb711a7a4f2990.exe
"C:\Users\Admin\AppData\Local\Temp\ec8fa207c9e21e181fcb711a7a4f2990.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ec8fa207c9e21e181fcb711a7a4f2990.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac9b346f8,0x7ffac9b34708,0x7ffac9b34718
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3247223128552679138,14683119747800193224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ec8fa207c9e21e181fcb711a7a4f2990.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac9b346f8,0x7ffac9b34708,0x7ffac9b34718
    3⤵
    PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\595fbaba-ca35-47fe-810d-8f7d2c22c360.tmp

Filesize
6KB

MD5
2cba7fc556cac1590512cdd95f1ebc8c

SHA1
fe2b08e3d3f903de758f68f916fa95fb494c1085

SHA256
918b4a1539c74dac2a45e9df9389814f51cc7079972047787396cd1edc6b4bb0

SHA512
416e4d3e6f2ba9b5c081eaacbd662e2f812ab9f5bd94ae85bf6e4af43b0ce823d8da3f40dcbfaa57cb15471043cbbf355b06b7ea38ba9b177cbbc200cad47a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
75d501c942855cc5c268ed56ec1a4cca

SHA1
f44db6e114ec10aa3eccf244f9d9f104f323f8fd

SHA256
82418992e22af8d82aa3c09af830efd1c0a6daa4d4ac2373ebce6dcf357bba30

SHA512
b824319d43c26c1a7f2025740137f0e3bddfb4a245afab7cf0aa425252cf94c623933451960246067ee99dca4389b07c4f0ef48061517a14f6c5a7300de7cea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d70d5ada3be3ad0c38c1a8330ea665e

SHA1
2a3c6b7cd3edee6792b857d7215b3355a364c04b

SHA256
4c01540bc2e9eeea47ae724449105e5a2d1d046f39c8e7b10e52603b94fd34a8

SHA512
b366e691f988ab2cfcb8a6cef262fe225cc99fb44644342ce9cffe8862a893f2cc1ac94f1e03e0e9c5b2713433287159219db1624a647310b998872e52aa1eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c47a5c865f406b7957ba3ccdfe34b948

SHA1
7ffd1fdb40d3ccadb85ffb564625258066a88d99

SHA256
b422ef55bfc618b0cef5b581ab4db6084e75460a5f56612f962a3bb6b3fc98a8

SHA512
a1a1bda34ff5cbd5b48ce5c676c44fcf9564304d0102fcc9e1ef9cad9f3f7a4829c5059428f4797aea604ef1f20eeca1138737fb509f85f784c9eccc3e1c1591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a20d87e41eb8c2444a1a6da7de1995ff

SHA1
24fd02c4e074e65397f86511429cfc147e5a5fb3

SHA256
ae998abf85f4efdb63ccc7203ec2681bec862478c6623a889cf63c6c7689cc53

SHA512
12c97f6a0b69b1f93247f791c25a96bf8059126bba32b39f14dae91b06afe77d6dcd10e2b97eeea165ecaff3bab2647f4e663fc2093c814ee4b4d45a8aee0e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588911.TMP

Filesize
371B

MD5
8a5822ba51e40396e017d108f190b448

SHA1
b1ce47b7118bd63db92229ee38f44cdbf757fc28

SHA256
c0dc6d3a4a8b06569b8b8a002d7afbb306f118e79bf5c011d880f6863ffb923f

SHA512
d1734782aedce376703617308e8b45590d6e45562c8a39a6817710ef4c7cc8364a2a6a3d3e97081e7e8d308d6b4f7aea8db9d47b9ab2738f50c3e7f01c90e7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62286e97e140b2698a82fd957afe152c

SHA1
d56f3b12da3c1e69cfe45ab3adeacd39a476e9d0

SHA256
101d7eb346b766a803234d02be3936340856514f71a214ec0ded33d6a4a86538

SHA512
953a65a2921b9a47f26306e6fd2908a79392056be2a5b5c39c1dd99ede37797340b19c32959e0a5b172386f72d8f8864afce5c231632112b9dfcb3409e4e2d05

Download Submit