hxxps://mojang-microsoft-verify[.]onrender[.]com/verify/minecraft

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mojang-microsoft-verify.onrender.com/verify/minecraft

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
1584	msedge.exe
1584	msedge.exe
3780	identity_helper.exe
3780	identity_helper.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3012	1584	msedge.exe	71
PID 1584 wrote to memory of 3012	1584	msedge.exe	71
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2796	1584	msedge.exe	81
PID 1584 wrote to memory of 2748	1584	msedge.exe	82
PID 1584 wrote to memory of 2748	1584	msedge.exe	82
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83
PID 1584 wrote to memory of 3608	1584	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mojang-microsoft-verify.onrender.com/verify/minecraft
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7c7246f8,0x7ffb7c724708,0x7ffb7c724718
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9451909695176367131,16243862544562284166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4db60c9bb06ea5452df26771fa873ac

SHA1
c118183a1315a285606f81da05fc19367a2cdfe1

SHA256
f168242e74bfde18bacb9e18945a39bb447188eba916c7adf0f342ed8d82281e

SHA512
180ed98f9d5a14a22687a099c4a0ba6b586610f7b8b4c8de89f3b91713b07a2ef3726fcd318cb4e270b1745213b898037d29cca4b490d0c91833b797d69ac406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5b0bf4edca2187f7715ddd49777a1b2

SHA1
eb78099013d0894a11c48d496f48973585f0c7c0

SHA256
562016f9159ef363fcbe62ed13ee26052b31d4f67dc5ea6d60864a7d5dfa50a1

SHA512
1039b98cffd32ca4c9e37486b96e01b167d76b19dd8440a21da4932d677c463f4c5ce2260239e8337f59bd61ff3111905e23ab71d3ca5b20e7d2935fea7952c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
02f42f30ea81013038ba0cdc9326e3c3

SHA1
a1b2b17baacee22b5cec7c0e813ff44b18d464b2

SHA256
d2ed35447f74bfc522e0e7513522616f328c1ef708280935c9dafd2a7a1a1b68

SHA512
1135e2e0cd1d75c5e33a17206531493816d3a1790dcc3158fd1c8d5faefe5cbba43375fbcb20147825b90a27598bf291ac985382bef9f7761325cb81676dc20a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
17e68d16a38184af9f0bd89b496033b2

SHA1
a862e250e71914c5c97356ea315a44fc56b9cd09

SHA256
4639004f75bc73e844c524fe3b8d5fc5f97ce01d1872ffc3e2ce23dbd99d0bde

SHA512
2d10d54558e06a73a30c84b8007e8b1c3f6b83b4a45bd4fd91e2c9eda4b7ae312bd8331d71aa4edd0188b2b1b173cce7c43162a98906ba3b195f211f62671a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
444B

MD5
f5042a728fde2ec37a92e25f07b9ee32

SHA1
41928c886456f1ccd5c44c4dfe6ed0c38f55dc47

SHA256
1138e70607b35179fd3f45d54907ab2640f0bf8cc4953ab10c533bb36727cad9

SHA512
ea640043769654c685665905b9eed9502055f0d8245266718b3d1b9933b9d91f27d0e81a539e8a298ef22c2e7617d69e07ea144195fbd66c092c5676afd8f720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
374B

MD5
c4c00b53bfed9bcdd51ab8736c6ed605

SHA1
93d3367c5b0b73520c5f2b1d202000a9278d1f48

SHA256
4bff0f72aa09004a6c2c1b8bc0c0d69899e49e6e79d8a21c1bc63654225f1923

SHA512
eccee03cedf0c3bf39c59b13b557464bfecef653963ba67895425e9d237f86a46dd8e3ec0f92ea177162446d41ebd1e10ab53e81304f6d184f820e7d74e46810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c4c8392267bba38f762e665a7373b42

SHA1
72a2fad555e81b61a47ca67bae9cd1c8737da7df

SHA256
a03861f0c1dc151161457c645d9b01feabf9eca83c4782cb048e41679e140143

SHA512
f9d1b10a1203244803e67ad15ade7f88937032244bd3c02e4d753b7006bef1601f448d667fc72849d593e4fc4e78fcbba56e852e35823712f6f77e7bd16abee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d54cdd4736b468286add960b6709ab1f

SHA1
836e305a8a42d2b387f5649d58977be704a6f069

SHA256
e2cf1bd5b61903972d26bf3c9a0f434f358659a94dac172d5e06ddd23f6c6e05

SHA512
347cebb8332b49701f444e3ff8713225452b1b545a86295afada09eba3517e31f89512873d8a326ea32e74d9f273aeee378c67bed54cf8c99b92232c36a7c5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2103692d14a9ca6ae27ad1f70a965751

SHA1
48dcbf3a7267ec21a685da6f2a6e847f99cb898a

SHA256
43b3153a996ce6002b4c5701d1d8cad748ccc4a30f177f59df47a826c4832628

SHA512
b3de5bd4dd0dcc200384acacab7e677f3e2bf9cdf759c7972b1ade8de42e1541350b1b2ca500ab4f98c8bdf59d8ebdd39a5348204b388c73770b0e319bf76f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac56a541af83ce956e8ae959a32679f9

SHA1
f3f32a0d29bda400c06b5586e366aafb0bf336ad

SHA256
7d075a50d384eaaeafbcd6b7575cd769559c7f2c50ae5652eeefe5fdefc5b9bb

SHA512
b01f79bd25a2c895ec528ccb51c1834b2851005be1d55825b2079465e77336d9337f15b922f21d07413f86ff615092819b066dfb4546c9e7c66c40a230f9dd33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3253bb0aa200d7f3c11105cb389596a6

SHA1
6ddbca5ab8bec73669e249d6b9a94208f6fd1edb

SHA256
9819a68374c81ff8df17c9c8458dc91ad5f321a00027654903715ee281a09569

SHA512
1eb975bff70349f48dbe7d8caee0502c9e1aaf5018917f6a6e1071e5bd5d918b339cf0b22cfe1fb8f71a1e52f072cc9b6216c4172e0edd729d44a5d143a265a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
c7e2022048c42b876641a25446a84ce8

SHA1
6fe9f462568562029537727654d4deee7a517760

SHA256
f52e62e638f7d69ef163df86140e5b0e0c13eca6ce8dc9c627f47a048ef81a7f

SHA512
a3a974f2314089a682bdb17f8dbc6a77be321313fae46f1098c6c19206aa5aa5954df6cf3bdcfeec6d06e7de01f415e840be45f00b4bc498f2a18761588aa869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
7eacccb856b3408d5506d11933391993

SHA1
94bac272a33d8ced5596f8f6e70518f8364eb4fb

SHA256
9be2702c16b005ccdd38b22d9927a30825a9f8a04f410f7568688b5eb212a15d

SHA512
c846760ed1a4712ab343411f06dde9c123ae9f3d83404fad0bf6e0f3b0e2f1b26dd53165b5511bde12ed0fe7a3a5ce9a4fd192e9145b432953bf514d24c1a186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
31fc2827e0a5474a09830ee1a8413026

SHA1
78c93ee7d2843ce9ae1caf7013a54732fbfd4b44

SHA256
3b90069e844228c304e4f70d946fe1869e0265955fbc208741acd2c68bd47b41

SHA512
56830e35579270c2c8bd29efdf6985ce1133ffaa5b2d1b5ba43544d9247d581918aa747cf9499d935dfe86ec377e184e2a312f5f8d3b73effc2ea95451ef182e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588f89.TMP

Filesize
204B

MD5
2f50f47a215add04517d339e20b74004

SHA1
51937bc75684118710ba6c3e9c510e330b63245c

SHA256
4129429446137f691c7d75047bcaa02945d3161f03e14d259dda9bea167dc962

SHA512
850e6fad731d1b029e602ed4070e11ff44ad57ce2cf8f3aa7c13ec76cef1ae16fd28b75d5491335982f0ea4ccba48e7e088dfdc0a18b9e6110eaf4b76b93bf61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14cc5cdb14a5ddd522602a4b20d64f70

SHA1
20074c8ef67e23387a26ab3525c18e0783704ca9

SHA256
a0da9cb7f3c5f5e3c57642f3acf68ddba3a8f530160072154fcc95ed052190f1

SHA512
644873cf027f072050014262070004fbd652784edd055993276749a29a884e0d744a6582dfb8a363bd6c17c7dee72c508c9ffc18ec18e48271b539745afa270f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85c5c2ea7a071672da103dd1da1b06b4

SHA1
00b3e4832e65014e5b98b83e0b0a37e35d3f85df

SHA256
e9ee1c4dedf7a9b64637be5ee1567e5f89975555b3de46460eac295d51070383

SHA512
894c14ec4befc4082366f869bf42e5426611487b74d9cffd4036bd185fbeb22b8e16dbfabdf33f412cd75cdb66cf9cffec92e1bdc61d9eaa5a29277d8bb7c802

Download Submit