a7f5fdd822eff017a80b5242735117bcc4b6f89e412c090231f9bafc3a53fe18

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4364-271-0x0000000000590000-0x00000000005C0000-memory.exe
Size

192KB
MD5

0b31c04674d2041824e6859dd94677e3
SHA1

82bfc86feda0c387e912f6f5b222bce8fa7ba437
SHA256

a7f5fdd822eff017a80b5242735117bcc4b6f89e412c090231f9bafc3a53fe18
SHA512

ffc2086e3313ef1333de21cfa8ec1b6119f3d95d17366d5020eedab18a16357868cabfca1c18f4f4621f5c8b80c24a54b3798ad46abdaee3522ea765785596ba
SSDEEP

1536:bhbEey6y36sv0W7TDGOIrHuyk7xk2W5/uGxNFVYQffbuclGHQ4N0GkRE8e8h3:blEebE6Cyk9i5/uGxNMS3azNX8e8h3

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
4540	msedge.exe
4540	msedge.exe
2212	identity_helper.exe
2212	identity_helper.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe
980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4540	64	4364-271-0x0000000000590000-0x00000000005C0000-memory.exe	98
PID 64 wrote to memory of 4540	64	4364-271-0x0000000000590000-0x00000000005C0000-memory.exe	98
PID 4540 wrote to memory of 1508	4540	msedge.exe	100
PID 4540 wrote to memory of 1508	4540	msedge.exe	100
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 2900	4540	msedge.exe	101
PID 4540 wrote to memory of 544	4540	msedge.exe	102
PID 4540 wrote to memory of 544	4540	msedge.exe	102
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103
PID 4540 wrote to memory of 4428	4540	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\4364-271-0x0000000000590000-0x00000000005C0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4364-271-0x0000000000590000-0x00000000005C0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4364-271-0x0000000000590000-0x00000000005C0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa319b46f8,0x7ffa319b4708,0x7ffa319b4718
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4647349982766985839,13154340952841860525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4364-271-0x0000000000590000-0x00000000005C0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa319b46f8,0x7ffa319b4708,0x7ffa319b4718
    3⤵
    PID:5392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
774b2a575589a73e1c64634f802b13e7

SHA1
12dafc0c742744d01b8e70336e50c56edd8d0868

SHA256
a92db6af0bd19208faf3bb7dbc6dabbb0ec3ee07fae77b0639eda8eeb338f1e8

SHA512
33a9f3b7476ac1f53d8572a58470b3d15971d5b261b9152a04d971ea078eb4d28e85ead4923d63fdf2c78a555536d610d1fede65dc4c76e2c3262e7eed64645c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f0aea657e6bd33141f6509a741a81c1

SHA1
f4ff6fd6da2e00362395a0905479502b5a08b528

SHA256
4c6c1b56cbe9e83ee362e862441ef7e393cabc0d89bcbf97ffc609249f9fb8ea

SHA512
d16de14870a22d91651b96b9485dc390b3fbd3a964ae56610ff21c87773ecbdba01193a43ccb0c18fbb8fa76bea1765a05adf902dd44eef32e3850d9dbefbac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67d012d7fe9def1b228d1b1dd8fccfcd

SHA1
087bc492b6818450fe4fa75c517ff40c1fd4cead

SHA256
800923f757d33cc3fef79a0545d46cb5a09357fdc939a2ec0c548b595ec804a9

SHA512
c6da91f6a8b5257ff5982cdf1e066f6510437200e324ec08e12b155288339275af2b695f743a99aebbe49038bf48dc95a525f561937cc98dc36888ff16136505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8a5acdb47f45737a3e72d5daea810ff

SHA1
25155109c8375d084727f3f2405a15756e1803d4

SHA256
418b7b1de90fc5071928782adce721f983dd3050f0f04030ccdd395ed46584dd

SHA512
1aec0d4e7126b24a62586ac894d758aadf05ed17067eb19edaa1664af38e3f2f913740372a8a170db2437df6635a4aadde4f72cd66a9fa0dae71be1eeb1e4451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
5e5b03a31f273728d339b93307e722fd

SHA1
d86ef996ab541ac05418ae65cac86e24e0adc534

SHA256
85da4eb47d8ab0c868b6e91993d8ac46066bf24d9172481c6bff8b053e0065e4

SHA512
0592a4d3b3d69dd4cb0dbc09f40487c9c7b9c213db0db015eb0b057beb59f8f543d8724f0c19833270b9ed4b6c36d286e0d9752bd5d4f5be9e68187f6593fd98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a42f.TMP

Filesize
371B

MD5
8edf231227d0ff1e9095a9f487b7b667

SHA1
6f4fe853f7036a6068f08b199bb192cbf261652a

SHA256
06cd96a279f9231095232e8600b4c6bd5b3f9b05c00227a2a1855766f86798a5

SHA512
e5d16154f24b3b6d588cdc4330c8d1ee1ed2e98d09578ffafda0429186d3f1c994090b9a809120178d58b0cd18502d1531fbf8f0d72774a2e377adb5858d97a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d88682e1b05cbbfdc333334c9b791d69

SHA1
d42526e9f94a6cc95991bf9d5799b361e6198b63

SHA256
599186f421857c1681b1dc515a73684ffa0241e1b7a15b5dd19af86e552f8f1f

SHA512
b66724a6270f856131ab2dc0b26d7508c440147846789daf0fd814e5ea1e0651e2d4bf62c2cbc52f9eb83754f8252684757bf19b5e87b9f4e5d554979ebfe6f0

Download Submit