056cbf20417d86308d9893a7a317266160e302cbc04295c6f812e574e2f6b150

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c343db4b06b1f3a75d618d619ca25131.exe
Size

78KB
MD5

c343db4b06b1f3a75d618d619ca25131
SHA1

9833dd80f8d7b8e3aac83f197076728cce38ae9c
SHA256

056cbf20417d86308d9893a7a317266160e302cbc04295c6f812e574e2f6b150
SHA512

762a9176bf3242af9c0db09ae5801f62b570774dc5e0b46ecdddb058a8b6622ae67e125885644445202d669c4ff91fde2231dcd9dbf10d846b213b9a1d7a6ac4
SSDEEP

1536:xSV5YXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96f9/Z1EU:xSV5gSyRxvhTzXPvCbW2Uc9/B

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
4052	msedge.exe
4052	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4052	1516	c343db4b06b1f3a75d618d619ca25131.exe	95
PID 1516 wrote to memory of 4052	1516	c343db4b06b1f3a75d618d619ca25131.exe	95
PID 4052 wrote to memory of 4348	4052	msedge.exe	96
PID 4052 wrote to memory of 4348	4052	msedge.exe	96
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 1812	4052	msedge.exe	97
PID 4052 wrote to memory of 2956	4052	msedge.exe	98
PID 4052 wrote to memory of 2956	4052	msedge.exe	98
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100
PID 4052 wrote to memory of 2672	4052	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\c343db4b06b1f3a75d618d619ca25131.exe
"C:\Users\Admin\AppData\Local\Temp\c343db4b06b1f3a75d618d619ca25131.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c343db4b06b1f3a75d618d619ca25131.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0f7b46f8,0x7ffd0f7b4708,0x7ffd0f7b4718
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6329851335313088663,4321931165872287576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c343db4b06b1f3a75d618d619ca25131.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0f7b46f8,0x7ffd0f7b4708,0x7ffd0f7b4718
    3⤵
    PID:5520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
cbde0cf9479293e4580a5db868581037

SHA1
6182ba2ab7ad262997ab96863b93629621f1439a

SHA256
20a93a507838ffc0725c4b34e16715250e5fbe40d354c09fda46c2f0c449e2e9

SHA512
07960ab5344757598fb39a34e89e27cbcd70634d89f8bfe9bcc67036d3a723b89178420b296384ec75da24b0e820790200d4415e8844f30f24464aa3a4dc4333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
decec17dc49d737a4bf150e398010a77

SHA1
fc7a15a9ed2b74fbbd897a6e3d709544d4010bc8

SHA256
eb1e39f72be928de2c013e41311574c0b3486de272b91c3ca420998f9b6b63a4

SHA512
c70722d425dda0c3e4bab5d5ccd7493bf6f6dff6e706fea2bdf56d22c836789544ca0d6a1946c7ebc665aff59bfe6ceb0d311cc34189b52ad93088f31aafb7b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb017bd51bc1a18fa7b3a63c4807e4b2

SHA1
ce0a36624240ddb882c6da00a9ddb2262b35acf0

SHA256
b8dcd7ead2dcfcdd59d8855b24df28ca66a7edde1a261c459e52fd6f2b779b91

SHA512
d1d3b25e80c7669506425be1274e0da8651c3a2ef22a20b14a90909962f5e662ff36ef13b579c1393fce1d2b15ada83e751813ade5228e31f84d6b3a2fdfc2b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0c905d2bdbea57fe09779a9deb1a76cc

SHA1
717516ea5fa8b13b22c857b78d76bbca8dcb8e98

SHA256
4f78e9675095d71dc419604a434e308a5e0a32ef43dec1b50ae2e358e1157f9a

SHA512
7ee5542568219ccb069b39be7f2c6a399be7d82ad163e4d6fae17041c60a043cffcbc30652bc8c4b0b934b3cd1a41f348772f1d79be3b47e2478fcdb93e542bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dd12.TMP

Filesize
371B

MD5
5df63e08b2a8a5be39e6b4967544426f

SHA1
d6434998f93f81754c29ba67d66abc291080e65a

SHA256
a803c4f8a7a2cedecc4de9fc5dd6e8b9fe2480a7b49362de1f0ac993acfba5a6

SHA512
81dc0cf4d6b2ba123968177976c8fc59c132f73a8242244481b0a81d2c3422f3e966a81364f839a2d16362fe3e2a9e84921577075a7451182c45e2e002c05e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3cbba03-f71a-46ed-bfd9-0bc93dc2c58d.tmp

Filesize
6KB

MD5
4556463493a0793196797d73989c3c40

SHA1
29e3af998ac70ef19d4fc3331803f2f89162d3e2

SHA256
c1cf19e8ebe1c5ddd91225885473ae50825e46da1c98c1a49a669e0454978964

SHA512
d943d8d79ad6d3ff60ab590c97594a5bb4673a9d790e10645282d7884884c76d661c518dbe5a6a4f1a8ac3a6acda4542eadfb45249ad5e7f6877cc7143bc8f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a7c15b8bca544628701a7ce36f5cbf2

SHA1
7c5d1cdb66c16e61716855d390657db99973ca4d

SHA256
fb9e352c671136410a572a243dfe1ba0592d995fa7f45d703e59be6e848ad376

SHA512
c0f89f776ff5027e5208bb149ade9527d5298bf8339529615f4c084aab85fbfd0385c8508c372e128d2e9d03aa59541aa95177e3278357d61f41062cf8808961

Download Submit