89f61fa916a454d882bb51801fbca8fa13d5c188fc4e780d9113812f49b9c1b8

Analysis

max time kernel
156s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c14bec8cd272e8126fae86aff4833ceb.exe
Size

4.0MB
MD5

c14bec8cd272e8126fae86aff4833ceb
SHA1

0712293060ad15646d50e708ed126a774e968732
SHA256

89f61fa916a454d882bb51801fbca8fa13d5c188fc4e780d9113812f49b9c1b8
SHA512

f16e0bb26911bfe936c4fc2d4d32ea6a22190572b2f9a283a9dfb55edd35b74c70911dda055b9a00e375b90f618036bd02ca0c4b2ae97ee95c22204f677e1050
SSDEEP

6144:vxb4lxG83BGQFps74xdZL4Ego5ZyVWu356Ro/KL2PstTu/uo4tUaigIp:vaG8h7WKZlZET56WKLx6uo4t+J

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
4012	msedge.exe
4012	msedge.exe
3676	identity_helper.exe
3676	identity_helper.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4012	2104	c14bec8cd272e8126fae86aff4833ceb.exe	95
PID 2104 wrote to memory of 4012	2104	c14bec8cd272e8126fae86aff4833ceb.exe	95
PID 4012 wrote to memory of 2344	4012	msedge.exe	96
PID 4012 wrote to memory of 2344	4012	msedge.exe	96
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 2220	4012	msedge.exe	97
PID 4012 wrote to memory of 3652	4012	msedge.exe	98
PID 4012 wrote to memory of 3652	4012	msedge.exe	98
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100
PID 4012 wrote to memory of 3504	4012	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\c14bec8cd272e8126fae86aff4833ceb.exe
"C:\Users\Admin\AppData\Local\Temp\c14bec8cd272e8126fae86aff4833ceb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c14bec8cd272e8126fae86aff4833ceb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x84,0x108,0x7ffbc2f546f8,0x7ffbc2f54708,0x7ffbc2f54718
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,13908767770035669452,1829432851950776247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5552 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c14bec8cd272e8126fae86aff4833ceb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc2f546f8,0x7ffbc2f54708,0x7ffbc2f54718
    3⤵
    PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0a55b0a5563286cce5cdf763a086e1ca

SHA1
fb36ddda76e4284bd1a96b1953838045455ae1ca

SHA256
ccfe369c813d0afd061c38348e334d2f9dc93d7c259697f6d4d219ae35a91441

SHA512
97051fb844d5f38fc40af2676d895bc6c8846cbafca07b6d016bb26f62287c2b646cde3e9a88689949cbb48172700db344c10beb88c6c0eaad0043b9e68c5002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df97e3291df13d1fd25359ce07b6e0d2

SHA1
74ed9d91f8636091e9b9255c9e0e132ca5be581b

SHA256
18cf79a4730dd6187fbceeab0c91fc27fd41b8cbc26d35a7b5c726f0a7a65666

SHA512
f463e5fa6029e57c2b718ab1c8033bab5b2e3d98e3816600c2d2a308e5063347d70cb68556bdeb5264ef30e518caabae15dd9e92490e0b662667bba72ff59011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63ddeec87620d8b09415e1ed09346abf

SHA1
4afd6aebd3235149b021f039468c1a89d294341e

SHA256
de029535f4c8184ed798839e52c0a4b6141ef2a2f809c7fd75daa7fe81939284

SHA512
4e255e8a8d95d2ee9c0cb0e99429edba98770822ccc805f142c6ad6fe9e45d583abd77a06e28dae6469dc3a8df0d4c5d5911aa37d5c0b27be036eb4b2ce63522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
489d6b08f481bba5a2e4fa59fb11a056

SHA1
689f490efb96413b7506b1679e8242a2c2a9181d

SHA256
53770754c8ce76ef39a9b9beabf42386d3f214b34f56f2fce6b919ee69f569a1

SHA512
ce350029d3d9985dec8e291918189589471e9a6eb1fbaeaa2420d7c61cf655bd2eb09173e339d3185b294eb0c919056798314a42292442390107c8ba6b5de660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1081881c5f5825f59de88b425e3b489a

SHA1
350b062183b6de18adddcbe96d7c8e3fd943950d

SHA256
a31864338f61b8be4c7d8a75e3c556887854429ec79c09390616828e0e518013

SHA512
ead955ab6a8de2a4846a337b77a6d1159c80f34442079e2e78ca5d6e41c9d3d5898664f4b84709b3c47ec69b65ea1d108872aa6fc77acb087d98cc42e353766e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582342.TMP

Filesize
203B

MD5
26c964cd3e8a14893342e3eae09cb4a5

SHA1
7917d11ebc968d3ec62d2817860e283c348115f2

SHA256
673ac620c217bbf516f8a5793c3686b07424a8e2a2fd5874266d92fbbe0bf37a

SHA512
91cb2457ba58853abfad996994142954f0f53f848edb6925687fcbf206682c747d1d00d1da0fe7ffc280638a6ff4fd6bad5d25292d24a0cd21855bfec73b39ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5e426bd504d8c553eebc95c3295b0e48

SHA1
e8a5ea749b7a3eb28919af37697426cf6c1898ab

SHA256
0920e73bc28eda7472426d1a255fbab429bfb8d96bdcc9bbe177819a1c81b49e

SHA512
e4cb38af696b4c8f2800de845b50d66e046b23eaafbc7bae50e6e5b413a494faff5edcf2141cb9249ba7d4579e78425888af9f9ca845442ceebee74bdcd35539

Download Submit