9f9eef7d914f21c3c01e76b7236cec04d2e282610ea36e268f6856729f1f7c2a

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

805aaf71dc147f846b60bc3b1f361efc.exe
Size

78KB
MD5

805aaf71dc147f846b60bc3b1f361efc
SHA1

003a7b35bfdc538c8addd41a60bb53edac458ea3
SHA256

9f9eef7d914f21c3c01e76b7236cec04d2e282610ea36e268f6856729f1f7c2a
SHA512

9cd4dab7ac0d9025f02c5d45d98fe11adb4561ecddf7a5c4af3ca96aede756baed00e05a71e56408068faad021d664fb3b2d6a844e25c19117dcef1d8610f2e3
SSDEEP

1536:YRWtHF3JIdXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQt+s9/8U1NX:YRWtHF5INSyRxvHF5vCbxwpI6W+s9/8k

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
540	msedge.exe
540	msedge.exe
680	identity_helper.exe
680	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 540	4328	805aaf71dc147f846b60bc3b1f361efc.exe	90
PID 4328 wrote to memory of 540	4328	805aaf71dc147f846b60bc3b1f361efc.exe	90
PID 540 wrote to memory of 3436	540	msedge.exe	91
PID 540 wrote to memory of 3436	540	msedge.exe	91
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 4248	540	msedge.exe	93
PID 540 wrote to memory of 2208	540	msedge.exe	92
PID 540 wrote to memory of 2208	540	msedge.exe	92
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94
PID 540 wrote to memory of 1340	540	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\805aaf71dc147f846b60bc3b1f361efc.exe
"C:\Users\Admin\AppData\Local\Temp\805aaf71dc147f846b60bc3b1f361efc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=805aaf71dc147f846b60bc3b1f361efc.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe2f6246f8,0x7ffe2f624708,0x7ffe2f624718
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14214618762598548647,14194812320103419909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3584 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=805aaf71dc147f846b60bc3b1f361efc.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2f6246f8,0x7ffe2f624708,0x7ffe2f624718
    3⤵
    PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
0ad58f1bb63fa6ad533034a9172d642c

SHA1
00069258af575a4ea693d834cf7f50078641996a

SHA256
38a7524d14330ecbbced4c14e408dffa324f4fe83b3893145640c129fc5d96da

SHA512
8bf7387e949f3e13b1c44f24572bb8e8a8352815380d7289f11bda49a77911097a6c4e149bcb6fd633a7b7b64c0fbbe48ff6e535892d5076b8edf13b77c6c488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4a57838db3bc27cf6bfe859ffdfda3ce

SHA1
884ed4d2cc406170931bfe82f42aece9ac1cc6e1

SHA256
dfd1c160d39c50e7cde6f0f0bd9da91eef7a92f3ef40ae1d97360d4d4bdd5dd2

SHA512
b9e8ab065aa5773409c0675aafd75df5d33e64aed3f9268ac6b272149ca1dcd54dc331c4880df7dbe2fa81470d18ccc5f1c76915b349e2b53a756b3bed2ce0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
60edbda0f4722dced357d3db5214ca26

SHA1
b0074275ca0e8b1da94bf2b9ac07c50d4a0e1f1b

SHA256
2e77a2e15fb1a35f6eefd5d1858381ee1896504c0eba540accaa460d15fc637e

SHA512
aae6b0fb84f461d27b4f9c04b95ddeb6910069491112b4a5a05f4e0e9e84c74a60529da6a1b92db27b4c3b6c1aac7d62deab1236cd062e614c64b96cd96b2afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7de19c635eb6239aa840349c1d894e47

SHA1
11a996883aa6be9a81e8707561b3453dfc43d93f

SHA256
d892573f48e849674c718808f57c5fb73cfe6d24fe81be376b380ffce74be2c6

SHA512
4cb65820bb8364c9ff73ed6cfba3f47858e97f44792146659a1ec026863dcb8c2d1507884718e1ed0bf8deb0c4f170fec0bb447c708bbfa3cd23dcf09e5e1311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1d3df0123109c7c4b9fa774dd460c564

SHA1
8dbe441d7cee06b5b4bdb4ee590e4e37aeade1d2

SHA256
ece435a59d7c2dcbdd88162c7b0f6459ba5194540aac0392242d50ed0faed9d1

SHA512
4021254b5a3b9d55a69151bea27a403dddb7f896746e616b2d45094a8ef76219c86d8814ea6fa93c032648811d1e3b5c0d1a6ebdd563be6a3805be76b6460081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c302.TMP

Filesize
371B

MD5
aca8ba1c60572b456553078036659e7f

SHA1
57950cd394abb6d741f63ee1b6b003d0be85b423

SHA256
c316e05ff35b5111f900a2552a3facc96dfbf7ccf0bd31fd15533723ed8c035f

SHA512
3c3c5f1ed9bf48a7fdf7f999020bc3b847447dac717f068ce495f40c949d9d6e37ffc0b46a032be8173a26f36315559b2b332fd3d65eaf3c3ab0e030da65a452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7fd9d3864052c3041d6862a664e28ea4

SHA1
e657898150f4cd758dacbb902a27dd467543453f

SHA256
c668caf189d8e959b625ff53293df7745fcdee4e94d6936fd5a738d40e0aaffa

SHA512
a419267f3b358f82c79356a9b9bc4c9a5d7c4d835b095394dcce1edb6f5e7310621baa6e5800b32ee23c3d3461d4f5e953bd96fc83a68d964319d0f75feb2ded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a496f37a8492141cc53a45d77dd5bafb

SHA1
2653c0306ca815becd1119abf413a9c785773ecd

SHA256
98a1abdbe424058f195678a8bc1fa7d5587d64ad944a5bdd0c56f586159d7ad9

SHA512
54e471658bb663c4c1938f0524dc94c733f71c621258c25521e1a927def4c9c4b8c079e0913daa9ffb9f569b642dcba4c82576bc33670953e0cacc9b73fb6cee

Download Submit