2110d6e57374a5395d23fa7180b43658e596df23808858a87bc2c13c63c61256

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1148-54-0x0000000000280000-0x00000000002B0000-memory.exe
Size

192KB
MD5

dd8e1debf40154f17c5a20426788e1c6
SHA1

9a7809e1f41beee9f41edd61a9f72276a4ccc5e8
SHA256

2110d6e57374a5395d23fa7180b43658e596df23808858a87bc2c13c63c61256
SHA512

b53d1c5633993868f2d06dca5f6680672d8e85edb33caca5634107e5223ddd2e35dda2b974cbedf1b98dfe8174ae9997765ef2f41820e376404df47919d578bb
SSDEEP

1536:WhbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRP8e8h3:WlEebE6Cyk9i5/uGxNMS3azNM8e8h3

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3424	identity_helper.exe
3424	identity_helper.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 3204	3284	1148-54-0x0000000000280000-0x00000000002B0000-memory.exe	96
PID 3284 wrote to memory of 3204	3284	1148-54-0x0000000000280000-0x00000000002B0000-memory.exe	96
PID 3204 wrote to memory of 3840	3204	msedge.exe	97
PID 3204 wrote to memory of 3840	3204	msedge.exe	97
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 4264	3204	msedge.exe	98
PID 3204 wrote to memory of 1964	3204	msedge.exe	99
PID 3204 wrote to memory of 1964	3204	msedge.exe	99
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100
PID 3204 wrote to memory of 3176	3204	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\1148-54-0x0000000000280000-0x00000000002B0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1148-54-0x0000000000280000-0x00000000002B0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1148-54-0x0000000000280000-0x00000000002B0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff86b846f8,0x7fff86b84708,0x7fff86b84718
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:8
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14281022566990906670,7638892878525243025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1148-54-0x0000000000280000-0x00000000002B0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff86b846f8,0x7fff86b84708,0x7fff86b84718
    3⤵
    PID:5448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
3127450f21ae1b4ed6d1766a0ca6c54f

SHA1
9260c191a992035086af4a145df60227e057dabd

SHA256
e8820e30789ac22ab093ce7aa9971748408dd0ed98276324c97447ddd2f17afe

SHA512
99fc5e4a5643a5f61cf935a37af3d9068755bb320aa19594d2c170699634c0de52431a6b1a920e3f21d3d2fd3287c3e6297fba1fb0a0ed35dbedb994d3fb0f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
985989c9ebe55507dd59b008820c765e

SHA1
0ac890f8fa8bf516d79388faca8f92efaf5060ef

SHA256
df72ec40aed4d798af47509db451947d909c88f917d041f1531eefb18d1c812b

SHA512
91b14db8451c747da4b3c28b46cf1382a01811ccc4b69224037c9a8f27f1af56f3e078a4549f72ef648e1b7b6ca0fd39347f1fae3b7c7406cc7f068c8a5492ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c07adb72a2be1b16dd8a5c7a5ea2921

SHA1
5f60e0307311c6070eeecc9cd62f7f3b9757e197

SHA256
8524901ef1a9bbc48a148d7567231981506cebe0332066833832dde35e65e94a

SHA512
99c6ec6d20b3c1debd72515f208107466fc5b56cfb377dbd71f6b74161a837841de03a3dd824254bc402ba287c01e2fdb372d47fce8ff2e872e5f2adb8f64ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
724b098975677343070c15ecad4aa78b

SHA1
0e4d84ce2b771d561472a1fc417f765d2a73f1bc

SHA256
d14640a4ff2d32d95547df60ad1bc9914bf173af3862f11ab79588745d918d5f

SHA512
96ff082be2b95c0ba1c1cb227e6063bb6fcf699e33e9e5af3d36b59bc45dec0c45e4f35425406e59487e106539702b68ae37d162662449d6a28daf8b235f5493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
66b742e6287662c12bab9dfee282e83c

SHA1
5c43fd8474e4a72611512c0f96ed7ba844de92bb

SHA256
ba63b43d07ea3059b9432ba2d1bab59406a9ab5956ac547fc2596178d423dadf

SHA512
4ab05d770b31dbe547cef86d9abbb7a3d58071a22773e1bfc0389d2d97a0ac36e83497ec295f787bdaf28a4f2620702d9ceb266a7765a1011ffe6f750ea45759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a3d1.TMP

Filesize
371B

MD5
5ff4c5cb9ea9c89b52b63798f3ced421

SHA1
df66577abbfa9711aa8e1eb7c40e5bcb954076b5

SHA256
42adb6783cdb8d2facef2f9503e11259952cc08b4704936ff953b7cab1130c9e

SHA512
57a13405b9ff14e6edb952ce794e491c59df32c08e131abf63705fad66d018f36a27b3726e1f344e35b67ce7a250b01ce2a5a86c5b6af03761120307e73635ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0718aa8f05a5945cce71e8a2e4e7939e

SHA1
83089cc8f2689074cfe2ef5242e738940b09c911

SHA256
5ad5908d7dace4c48a06ea469a546e4d3d59173b93734710c4a1fe388d9b7612

SHA512
d2109764a56bb4878cd367788adb4c261b9086728f09e9a2b9947c5d78738f6d7814ce8e03236db879a9089da8ccddc2cc4877d9b2c958cb0370a34e931a9477

Download Submit