975fe3318e851167ab999dc98a04fd63dfed5e9045065e9f92e9e44733c61bac

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10bf69fc724b493f8fd0b4021168c0f8.exe
Size

696KB
MD5

10bf69fc724b493f8fd0b4021168c0f8
SHA1

f683fd06ac88766eca278f0e93e921b14f00cf1b
SHA256

975fe3318e851167ab999dc98a04fd63dfed5e9045065e9f92e9e44733c61bac
SHA512

cb33dbd9119767ef2927ccdc4899679e79c913f65df9539fa2b9a9d1deecab486ccdddb8f63e562d029f53b6121adb101f94930a9a1517a7b4c7e023c5e08614
SSDEEP

12288:J6sKHd7DCTXBYDzvYuvGrqIVWZJ4giqjdWwi8L1eypbWQOQ06yClIcjQNQ4mIxfd:ZI/v8DVZwiCFMc5icEFmI5n05CuEjGMZ

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
2908	msedge.exe
2908	msedge.exe
2272	identity_helper.exe
2272	identity_helper.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2908	4904	10bf69fc724b493f8fd0b4021168c0f8.exe	94
PID 4904 wrote to memory of 2908	4904	10bf69fc724b493f8fd0b4021168c0f8.exe	94
PID 2908 wrote to memory of 4580	2908	msedge.exe	95
PID 2908 wrote to memory of 4580	2908	msedge.exe	95
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 1028	2908	msedge.exe	97
PID 2908 wrote to memory of 3448	2908	msedge.exe	96
PID 2908 wrote to memory of 3448	2908	msedge.exe	96
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98
PID 2908 wrote to memory of 2476	2908	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\10bf69fc724b493f8fd0b4021168c0f8.exe
"C:\Users\Admin\AppData\Local\Temp\10bf69fc724b493f8fd0b4021168c0f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=10bf69fc724b493f8fd0b4021168c0f8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95f2346f8,0x7ff95f234708,0x7ff95f234718
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4840444704720708305,16007598509528953760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=10bf69fc724b493f8fd0b4021168c0f8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb8,0x108,0x7ff95f2346f8,0x7ff95f234708,0x7ff95f234718
    3⤵
    PID:3536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
42464a54ed145f5952c2e7143b75918b

SHA1
2174f7a777aa62f78998d5d33a75b933ed9bb67d

SHA256
b5f1abe9a8937861acb3dc266bd86afd73b9e97773bf3fd2aa081a458aa97578

SHA512
9bd2ce720b063ea70c3a050ac916bc4ad7b1864bb3c38da87eb4556881214189a516ba662c15061ac9c891ed7442d865f234b7a8701fba027eba4a637e55a2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4bc9e73ad765370a938c1f16b075ccfe

SHA1
57111d8f962febca41b0dda799d7936696a41e8b

SHA256
7577b80bd87973855fa13f4ea762100d56632ed9ee9ba6590de39f23b6e56b56

SHA512
66df9dbc0ba6581114ce20d0b79bfb7140a1539ae5d726ab67b2be6466403aba1a5d9bc519b4b1db368175c2b9d7605b5323b5bfbe3642ca1ac3669707c413c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f1b166c08d1a9a0904b90dfbe14aeb0

SHA1
4606ec53df54ea323ec25c9f67c6f27e73c34b15

SHA256
79372fc208636df9b5fda204474cf095c6c82b2ceaf7883dc28728e5528dd7aa

SHA512
a91f178e685693a62e776649c7fa4ba1c3b93fff0d99bb78b8fefa8f0059b5882c6e2f7a80163c4742a3ee7fec17e268e9a570ed99232af84142b8c27c27f7af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0bbcb6e0b4ec31e66069814560d89288

SHA1
e11be5537a25e728cde2f8dc6aee68588d640d52

SHA256
e372c9d459f924929160e466bd6c39d54b51822eeb28f9902238636339225fc1

SHA512
e8e77f7c9f0bd2845d24df7280271e6029a406cbd134ede70d8b53b0c9d81c38574687beb1509867e93a1133025df7f7b6210ed09a00531a4a4359f10f38a087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5f1f9422c63a6e7e7833938b33e4363

SHA1
eb4648335dbaad5ec03ae2e755dff0b8b994a933

SHA256
56b966050eb320cf77f10eb77c75587a721e133f95f24ff9ba1eac7dc0f11cea

SHA512
7a15d18ddd2d5c5b81dbfe07b272912d93843758eac5a8a8f9bed702ee6c20318ccb5689b507fe94b93dbfb99756986f0136d8eba3518eaf637d31797fc45eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2bbbdb35220e81614659f8e50e6b8a44

SHA1
7729a18e075646fb77eb7319e30d346552a6c9de

SHA256
73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd

SHA512
59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
5e9e04696228ed91d97f312083caf53a

SHA1
a7201b0a0b449dbbfd9f22981872d17e67840a48

SHA256
bd5a1179017af33fc5b72a55922fcb1ff3e2d9ea7c2cbec707e5840197ea900a

SHA512
5c04ba2b44977507c6c52b6f403acba8234996267bade5ac4c63c19568f035586a468e5ea025182d0493837268faea478f42fd3d63610a819fca1df252390924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58291e.TMP

Filesize
203B

MD5
b10e2e142fd1870a9398fd23939b2ed7

SHA1
2be00a4e56d879ac0c6ca9a9390c43e66f0408df

SHA256
7c91a1730a571cf8ee79021828d147e0cf333ab7caa682c81c9c43288e263a0b

SHA512
3f629b5cda25329f189087da898e71dd9e32b45621f8c666ee27027d53fba15ebd3eeb3dc6ab43bb7717e969e76ab4f0959a2450285bad724923f4af56804635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be60326f96042e915efb63baf99429a9

SHA1
54e3d0769571709d936be1c6027a334476873295

SHA256
2befd00f8ae232126f09d2462fb9561c837b7051f3fd4b0d51335fd2a2408447

SHA512
249010da011256be7d8215c624d301abe6230a93b386d46369ec9a75bd19dcc152fdc41eb0cbe13e2e67a6aea407107697aaa1ca8a584901988b7b0e4dcb8488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
53af6a576462d4d3efce6bb318e5229b

SHA1
40c1bcf4b0b391a8d18b5ab9e2edac7730beb489

SHA256
3bd1383bac95fe862f4d13208b9c3510c70d27fe34819f7e8e060b45a89d191f

SHA512
a8cfe66b50bb9d9fccfbf7403bb140d0caaeac031ef439c6f716fe0b09996fde6c1ecff181bf64e7d6dd88699475e0785b0556aa726f504f5b50e302d796370c

Download Submit