971c2924223ad38175568579f72617fa58098fa4371f5a2f1dcdce5173b2ce64

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49555d591e307e83645773216f2d087e.exe
Size

345KB
MD5

49555d591e307e83645773216f2d087e
SHA1

b27d4e420825d7e0ca1dfd5853886a23688d367e
SHA256

971c2924223ad38175568579f72617fa58098fa4371f5a2f1dcdce5173b2ce64
SHA512

39a62601cd57e56f53dbef2734c58687daebcaa13abc30804598858dab1a8929d115ca7d30dafc262e7bfa5125afd7d5e3980259b3149aab2bae484d23b8a97c
SSDEEP

1536:9qAsBvLcFNXkw1Cmrwvf4VskUKrBa7HeZx1E:4A9TkutrXx1E

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4332	msedge.exe
4332	msedge.exe
3888	identity_helper.exe
3888	identity_helper.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4332	3500	49555d591e307e83645773216f2d087e.exe	91
PID 3500 wrote to memory of 4332	3500	49555d591e307e83645773216f2d087e.exe	91
PID 4332 wrote to memory of 3244	4332	msedge.exe	92
PID 4332 wrote to memory of 3244	4332	msedge.exe	92
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 3184	4332	msedge.exe	94
PID 4332 wrote to memory of 4292	4332	msedge.exe	93
PID 4332 wrote to memory of 4292	4332	msedge.exe	93
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95
PID 4332 wrote to memory of 4320	4332	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\49555d591e307e83645773216f2d087e.exe
"C:\Users\Admin\AppData\Local\Temp\49555d591e307e83645773216f2d087e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=49555d591e307e83645773216f2d087e.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffd9d8b46f8,0x7ffd9d8b4708,0x7ffd9d8b4718
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11687826419634017339,2454054602258535225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=49555d591e307e83645773216f2d087e.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d8b46f8,0x7ffd9d8b4708,0x7ffd9d8b4718
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
bd21da15e34e2c040c770265cf4abfe3

SHA1
978c73c286ceeb012edcd27491f6ae7105d6bdfa

SHA256
4d9bb54c918fc7ad8859132bd4e151ae8a0048eae92872367f0c1230bcb9e45d

SHA512
06d935c5f974acab9a04087dbb1b8363b13c83eb55419a15b8b08bdce14825f9125cda577e0c6100bb022391e959af9051c24ed738e006d320abe87c9889fc56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
42c1df1a37ace816ff1a5aa86e6c87de

SHA1
8ebb5977fcb63c49d721c3aecde5f5c4e9060ad2

SHA256
d3332e7712cdb3f3ea76b1c24efd2e65a3bd3d9433ff7c15836fda428f69e600

SHA512
4634698c99c8aa14024ffab9323f933bf2bfbc45198e086b91360ec2e8511662f66a7e2f0f21978536cd11aab68253e3d04bd732289bc72ac9f41adbe2ff6249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
442c8f513f76746428ade415fd2e8009

SHA1
361e2e221f27d7620016aa7fd4b149ec2394b640

SHA256
90198328a0fef97b267d231c424fc367e07e8410ef3101d97c7f3a3dd72736f3

SHA512
89dc198270fee88ebde4256ef25de06d103189ec1757e890c35a06d6f1c2c1a4c57a1982bf92cea2abe138d680ae215c2a67403a828c3daf8e315bf2b362b2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a9b0bd3ce37950eeec8db9a3b9352e92

SHA1
1b7b50bf03abed59eaa4c24b77303762e478feb7

SHA256
2ff69361ac8fd153aac0bda6adc87d3a72aec8f15111a5f057b5aff86e4ac290

SHA512
d1387dc03c514788124bff7508e26480aa0d45db96bbfda71f4f25f4060381a73b915183b9895516286f6af7802b483de5a0c8f2c25b1e958e3bdbc2995f3bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a033.TMP

Filesize
371B

MD5
021d6c380760e0ea7d0e972cd06c2de4

SHA1
335ba6f79864c724bdb7c5ac48d5cebf51727f84

SHA256
a2eaa878a885e3e76a8b3dbb0b8e8e3838aa41042ba187c1a038ae6c2ebdc775

SHA512
8fbc4bd402e116c7c3fdd9969d799a26a8aafa92630865d9df7ddd1b99376cda0972fb54346956208313758f5c8f882b160fb23823563557e6855c0ef8defc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d439b19e5d965f391500524dc1b01b0b

SHA1
a7ab9c833122ad7589c3ed0914ac4b11b1c86023

SHA256
d7cf56aba4766edeae170bf6ae7653f41e05a22c91c46f2c74383c27f2087669

SHA512
265689f5cd7d2bcacf830e9609c4b662fcd55aefdd002bd10da9afb20cb4b14fbb007af236d6e2809c61c1eeedea1565170fae46704bbbc6ccf0bf0a055c4b18

Download Submit