d95297a6ce437eb875b948db23fe977390ca30c7b9f685bd4c7c47f155177d1e

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1816-271-0x0000000000660000-0x0000000000690000-memory.exe
Size

192KB
MD5

3c77664987390719121aa88bac161bed
SHA1

f491445de4a573955a184e2bc934db2cdb107cb3
SHA256

d95297a6ce437eb875b948db23fe977390ca30c7b9f685bd4c7c47f155177d1e
SHA512

1f7e66bad5022e1990a7ce87d8816fa2855c05e8903488360bd48cb14ccf58c940fb51c6da66ae6e5130baaaaf720e6d9c52e8ae07558f8955f254ffab921ecd
SSDEEP

1536:dhbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRB8e8h3:dlEebE6Cyk9i5/uGxNMS3azNG8e8h3

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
4376	msedge.exe
4376	msedge.exe
4988	identity_helper.exe
4988	identity_helper.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4376	968	1816-271-0x0000000000660000-0x0000000000690000-memory.exe	96
PID 968 wrote to memory of 4376	968	1816-271-0x0000000000660000-0x0000000000690000-memory.exe	96
PID 4376 wrote to memory of 1008	4376	msedge.exe	97
PID 4376 wrote to memory of 1008	4376	msedge.exe	97
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1668	4376	msedge.exe	99
PID 4376 wrote to memory of 1840	4376	msedge.exe	100
PID 4376 wrote to memory of 1840	4376	msedge.exe	100
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101
PID 4376 wrote to memory of 3468	4376	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\1816-271-0x0000000000660000-0x0000000000690000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1816-271-0x0000000000660000-0x0000000000690000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1816-271-0x0000000000660000-0x0000000000690000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca78846f8,0x7ffca7884708,0x7ffca7884718
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6897699485082312595,2219176601776717060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1816-271-0x0000000000660000-0x0000000000690000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffca78846f8,0x7ffca7884708,0x7ffca7884718
    3⤵
    PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
74f6938af47d1121626e720546c48886

SHA1
64c7a17b4d38acc5b7fd70c1531663805cf715ea

SHA256
e2392b6f4a0d78d6b7f292a87014e63ad40a4746997413a6c9c8530ea446ed9b

SHA512
ef0635f83400d1756b4398f8e130c8345d294f2a8f4a72df68136be59c8b8d75b20384b718721e905a9c3734e8f6bef68fa4a2dbcc4ea9953d2b02dde0c7ce06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3c3b20967e77bd15d5edae6b5e76c5f

SHA1
f6409685f555d11f07cd7d72ab21a144ecaa730a

SHA256
c68439eeb237c317f4151244c86fc78b539955b75dcefd3b685f16a555c37d91

SHA512
392128ef551b1dcb6dd7d61a55a60e31aa959b9d00db5b8588fed2d4486639bf926fec3f77c24a33655c2275d8036af085e328a0f2a90a39de112296d73d7498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8d4cb164733da16770f656d5a17c126

SHA1
e85448a60c8be96b4cac8cde8a6b46ad57a1ea96

SHA256
65939d0d0b43b0d3a74b5c3169ee04e34424e9c51a3e2578ad931ad020ab53a9

SHA512
a552265a2738e0c97eafa44b08a09b86cfb5deab58c1fc13c8c282082f76d7f358406dbe178c5753463c7578505413ef86f2c28a90360a6db0cadab5beb10614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10a074ca8960a7bc53f5712c9f25b768

SHA1
4c9e8c2df756cea170b44c073f5beaeee0c861ed

SHA256
2ff21878bb07b5f49343419151699bfeac619a8b0726ef8dff92fa64523509a1

SHA512
d5de84b0450fe43609b078fb64233916f2c7f7ad82c58865ab2263d6cc6690d12a9f3a86f58e50cdb405124f3f5b820a2f6f6b99d6b2f1f476e88da8682beb47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
ca3a7f00eead61ce5695471a579aeba0

SHA1
d9aa9e3b0d5c0a70f651666be0ce6f42702fd556

SHA256
71f32ee6f27a315fd510abaeb4ebad997e9474928fa64b113f089b738f3fbe4e

SHA512
ee49c566f23379b4874683d479de293c023616a17607a1475e8c073e7575408b114fcae7d176e33ac15394d2f039a500f9cc122b632090e199fe3a8c6c2860e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce0e.TMP

Filesize
371B

MD5
4922d62426434bdda6f4d9335172d517

SHA1
8e0993dc622dbfcb8ba03ea87ad6ea70308c72c8

SHA256
de8e20f3f7615a307081553fd049529bb29a8c3b805cc5dcfc4b6a1a040362d8

SHA512
d90f90616de8c573ecbb4136c25b84489defd7aef2082ff29f8dd205b1926b24c6c55a7c4d06076666c4668974f100b994c1447466bc4dd4bdeff8875c15fac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9d58d9a33d2a25401ca01543b710376b

SHA1
e6fb8edfae4f07b0821f6b44852816152aedfdec

SHA256
3471d7745fa3ecf38a5aab8b2dc416479bd14afa0fb1761bf6e4594d9bb34677

SHA512
41e3bed4dab684e8462defd51d9ecdc09281343e81d93027f063ac19f03486337e8934366c1e5e8770a188910ab3fb088e1c40392a4093cb8955334554f1bc85

Download Submit