b736dfc0c45f5b528e25dda731661d5fa06cf1bd8c59f87567ae011b372ac4c1

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c04f0c2ef17540fc8619560ab00f091.exe
Size

78KB
MD5

8c04f0c2ef17540fc8619560ab00f091
SHA1

aadf618e0b63444419fd6b4bce97e9c7aeb218ce
SHA256

b736dfc0c45f5b528e25dda731661d5fa06cf1bd8c59f87567ae011b372ac4c1
SHA512

b6caa8f120299cdc9a9950a5c56d98e40f1a298757c1b418a3a7f03f9df40516dd5aae2dcccf35535169edb8a1b7fa60a1c203ae31213947e46b1573b41eba07
SSDEEP

1536:058vXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC649/Qj1f2:058PSyRxvY3md+dWWZyw9/N

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3684	msedge.exe
3684	msedge.exe
2292	identity_helper.exe
2292	identity_helper.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3684	4092	8c04f0c2ef17540fc8619560ab00f091.exe	91
PID 4092 wrote to memory of 3684	4092	8c04f0c2ef17540fc8619560ab00f091.exe	91
PID 3684 wrote to memory of 416	3684	msedge.exe	92
PID 3684 wrote to memory of 416	3684	msedge.exe	92
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 696	3684	msedge.exe	93
PID 3684 wrote to memory of 3984	3684	msedge.exe	94
PID 3684 wrote to memory of 3984	3684	msedge.exe	94
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95
PID 3684 wrote to memory of 3888	3684	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\8c04f0c2ef17540fc8619560ab00f091.exe
"C:\Users\Admin\AppData\Local\Temp\8c04f0c2ef17540fc8619560ab00f091.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8c04f0c2ef17540fc8619560ab00f091.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0a0146f8,0x7ffe0a014708,0x7ffe0a014718
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12896086325950467661,105689572730247771,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8c04f0c2ef17540fc8619560ab00f091.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0a0146f8,0x7ffe0a014708,0x7ffe0a014718
    3⤵
    PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ff82b3dee470dc86a146152ff3822665

SHA1
43a45dee2c2f63be2a89f8a3356af87f167b652f

SHA256
e25fe86b0fec08806d73e7e79521bcfe804809090e0751e98cb448b06703e825

SHA512
feaea00361bf9ba5f5bff34e22ecc46999e5de897d1a9b27f46812f578236d948cdc89a5c730861bb1866c87f35f1d505e4ae9758bf5d875355b93084a4abe66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de4bdd4013860bbf329dbf869709d999

SHA1
40f705279efdffd9f7334d93733460b46da76a12

SHA256
8c4a05088cbc963c5a0e96724374d81c513aa5e737e5114d769683b8363d4990

SHA512
095902753dcc75b771cadc82b2c7f07a16d62bd190352c4ebc45bb00d13fa19b108abcff1d43050e7d9572e92624b167228f48a2eafb56e87e5a5f7637e2170b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
97e48cf16fa02d348bc159b39ba5e6cf

SHA1
c8a532247381e20c80f1658ca476a7585ce78d38

SHA256
57f5c6de355faaf93958754588a5cf1613e8d72b125dd619f2a2c794d9533de2

SHA512
ba52074f44ca9c2c4a1ae4de5ec58393f201dc9afe8ae8210876d73877cc9e556e51807b4598f1d2c4d6603e1c176d48ca6ff0128b88d1aa34664a587caf1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b876203ab5c909a2d600f85e8579882

SHA1
55fea345f1d6bc718756c8d940dd52f21cc632ad

SHA256
6f582857f6ead561746b51d65f618213d7918ad98bc3e3316853e50271bdd42e

SHA512
bac7ab8ef94981a6da5e7c9adb46341db7504ea40b1979ae6b641091deadc7ce5ca2ee44ca27febab93de9bb3fa49a38af15d5d03309f1f7ff9bfb7349ed1758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
7585b6395ac334faa205eb748bb49e66

SHA1
f82ddec03712905b2650f44fd648498c108400dd

SHA256
fca6bb513e59271cf2de8199cd634b2d7e72af354b19f8ddebb66ccd9e8c2b9a

SHA512
cbf516250a271125ebd9417ad60e30cd85d16e0acacdb16b6e66c9a2b83714052401488ceb8d8a31852b5e31ec7424e83e75d4a28ef69a65ea3668f6866e16aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
72ac7fb2d2d92cd428539f2af9b28d94

SHA1
cda3aa2e703f3d05cef13f0032c47bf78f161653

SHA256
94d7df12b4f3da14e8bae8c0359823ccb44ab4c37961b40ffa61c55bd5f0d462

SHA512
1e7bb9a1ee2474a619c7d2833947147b9c0961ce20c038c38980abad8ad6debae91dc648d8c0fa95f277336cb1621a2d4ae4610e0133cfc77e9ad05be961e0d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c289dc60fec517fa5f0eedb3873061c9

SHA1
231c4323c46dcb0f047d1e8d5d3354cb58b07078

SHA256
84936e063cc853cd301029b87da71dfec6cb7a51ae1bc694b71d6497b547c523

SHA512
e6c8ec8397c6178e984ebcb8a4784ae11ba9e6d0103568e4acee1b18d15bbdd5ef80d35834a5e8db2d0a9b689d99aa4ec0d61d252658331e1fbc30d4a2c985c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bd93.TMP

Filesize
371B

MD5
92ba44aa5a49466be5ce3d3f2261692c

SHA1
c28bd43cb490d0d55626edd5812c347a2b61f066

SHA256
5d5a3a52bdf74b84d185d654fbe4e410c182581af69eac44ffb87d3071f9aad7

SHA512
055c49510782084a6c2e8e37b2b40e7927fb98a1cd77475ee440b3aac346ea0b9d9720b247c4b2a5592c160fbebde21867e5a91c7e954495b3df4465c4d13083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62ef16cfff4fe127c796aa00092d211b

SHA1
80dd2b5fb5a4bbd86faa5b1bd40368d1bfa5c24d

SHA256
e5fb890b9c23e98821bd23c7d117cf09fabf20b4252f0a99344f4946789fec14

SHA512
fb5eab7afd9449fc28f9de147018f6105bbc8c651ad89976cb0e639829b6563b224a566c6b0aaef7249b6a33267c279cc79868fd4ffdb440b53c79824e511f36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7925689efdc7f6806b078d42b4561ddd

SHA1
98a45cc4520410b933006304aa3cebc0f8c6f245

SHA256
7c8721d52de443ba3d21951de1f275c736e0c4eeb911d6d083f063483c31b7b3

SHA512
070e589d0acb5f616e4482c6c239a4b759cd434df1f55bd777b590769a881deb328e6d51c2596be57f12ef604c4cfbbf8ce3bf0cba9a4dcceac909490172569d

Download Submit