9cc5eecd6563569e1dc0d8bc27b4c37cd8395045dfae5c15f0bf17a926e152e4

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

772-83-0x0000000000280000-0x00000000002B0000-memory.exe
Size

192KB
MD5

e07670eb91b0494107d83e65600d4de8
SHA1

7553e65405a9d9155a5947aa64a3213bcba53bcd
SHA256

9cc5eecd6563569e1dc0d8bc27b4c37cd8395045dfae5c15f0bf17a926e152e4
SHA512

14e752ee41177a7dd42880bff9396bac88787a4dbb4169433fe08ab3b31102a878df62538e180c0d3e7222f9c3f236a0f88101c7ab8ffb10a6a1ac6328fb3e43
SSDEEP

3072:J47FCYO0NJQ5S0xNcIA7qVJeNGL8e8hy:Jvd0AEnCVJeNGL

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
2560	msedge.exe
2560	msedge.exe
3532	identity_helper.exe
3532	identity_helper.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2560	2768	772-83-0x0000000000280000-0x00000000002B0000-memory.exe	94
PID 2768 wrote to memory of 2560	2768	772-83-0x0000000000280000-0x00000000002B0000-memory.exe	94
PID 2560 wrote to memory of 4064	2560	msedge.exe	95
PID 2560 wrote to memory of 4064	2560	msedge.exe	95
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 4592	2560	msedge.exe	98
PID 2560 wrote to memory of 464	2560	msedge.exe	99
PID 2560 wrote to memory of 464	2560	msedge.exe	99
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100
PID 2560 wrote to memory of 2052	2560	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\772-83-0x0000000000280000-0x00000000002B0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\772-83-0x0000000000280000-0x00000000002B0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=772-83-0x0000000000280000-0x00000000002B0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8811f46f8,0x7ff8811f4708,0x7ff8811f4718
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16840197591567375392,11693526075907228945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4052 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=772-83-0x0000000000280000-0x00000000002B0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8811f46f8,0x7ff8811f4708,0x7ff8811f4718
    3⤵
    PID:5464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
c7cec880460ad8277b867d4a15782b03

SHA1
62e03f8acdf1e351053bacfe080e0cb65d508bc5

SHA256
855a1e994cdd90d9e90bbf795f92ad8324a11205794164aaf506bbb61610f3bc

SHA512
6ff99b92b2abb16fed4baf1d502ba822f5f8d8ee53e216871eb5dd428b37235bd3090c48731465773b436aeec5fc28c3c091945e36a83e8115236fc88fee702c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11f4ba5f0147a3a6c1f4bdb203648b37

SHA1
4226e70ec8dd1a83efe7d349e3a76fb603f1bc74

SHA256
4159cc3f6d3ee612966e1b4f0c513764adb972c532ae033fb63034d8025358b4

SHA512
2b2fe402401ab1f5205e32ccc9966deb6b79d287e29e72423856f7484f54bd684234edfda2330a6b3779871bb223c935ad5452c1dbf1fa26c955c41c5309a905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f29ab4d54001fdb4567be642f151b78

SHA1
e80aee191adc72f01f549874bae43ace7868e610

SHA256
5c9ede1d23988f2d3d65b93ee24409af51aee19e363eb69deeb03590a103368e

SHA512
cfdf68a8ae795e5101522a4fd82d7bb53ea391e6791dbf13f5a07aa70fd058ca950a916c012dd95b1c7068899a32c220283b9b6b72baa3defccd1d9a68690dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
767ab7e0ec94ddaf0803ff23a68997fe

SHA1
92a11433e763a803aa9a2e1b3298047775c74417

SHA256
e38066eeb6bd8e7e089f343bcd6fa4d718479d9fd2feb7aba5b6e7b8083d1f22

SHA512
bd5fa7f3c479a02abefad92f5bce38b88d1c91ce9bb2c64adf5e6beab239f23d04ded96e2aa34c8dbe015026b32fc49cbdfee229e04fceaa589e3f138a96c057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8b0284b9c5a22f27fb2a93809a98d484

SHA1
3090e6f7e6ab0c8c81422de9dc5d2c34cebc7714

SHA256
08c606bea6afea0e05ecce44a363318d1e1651a8581e8a980e06a56c3bb43074

SHA512
3c676a5c609fbbee2205c391996a17c4322f3ce010d54c608c0b007c19b009b9365947f5f0d39ea379197a78add36efcf86c000e7c17dd26e00db4b643b3715c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c1d9.TMP

Filesize
371B

MD5
dd60acafc4dbf66ba1fe47fe1d940d9b

SHA1
b0342472c320b33e0423a050d256f17289f6269d

SHA256
37cc37f6c9bc05b5d0dfc91ff25722fe82dd4e32dcdcd63ae9e3f0785f2ea0ed

SHA512
2a82d58c6d41a6272bbe17ac53be55a12aa722ccb1759a6813b92aa47bbfcad0b876fe264d531885fa1d33583bcf88ab6a8f19dd479507baa00ed8851d2a6903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2b25593882211e0879b4691e633332a1

SHA1
39f5dc95d265bf0d4789ac2745e581033974fd7c

SHA256
a7eb2232933da7c0f541c8643270788f20ea45228b6b713bea60a1661f6c17bb

SHA512
a9e41779b4d97c5730226b0cdd898f5c8875062c2a8449a348bf380b1182248d7bf2407af2833d29b4d9ea5c564b9881d4d7043b982153556558f01a99a23981

Download Submit