ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79.exe
Size

166KB
MD5

85322c24c94270271eb452d44976209b
SHA1

1d2ee0385a2f49ff3b927a0b19a63414b57c64f0
SHA256

ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79
SHA512

aecfc958a7daefe59ea4a7749e7232a2a1bb845bc8d40f1e2f86c7a80ead950d42885dc3700697bea87cb681d7f41f501ccae7d05bee219921b5ecd6b0ccf568
SSDEEP

3072:49GNZP6hr2Jv+NwD/+31G9jvWhHg8XKkO0cAf+cJK/6hg:nNZChrev+Nwj+31GNWsToK

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1728	msedge.exe
1728	msedge.exe
3588	identity_helper.exe
3588	identity_helper.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1728	1028	ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79.exe	95
PID 1028 wrote to memory of 1728	1028	ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79.exe	95
PID 1728 wrote to memory of 2196	1728	msedge.exe	96
PID 1728 wrote to memory of 2196	1728	msedge.exe	96
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 3164	1728	msedge.exe	97
PID 1728 wrote to memory of 1248	1728	msedge.exe	98
PID 1728 wrote to memory of 1248	1728	msedge.exe	98
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99
PID 1728 wrote to memory of 1820	1728	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79.exe
"C:\Users\Admin\AppData\Local\Temp\ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xd8,0x104,0xfc,0x108,0x7ffb642e46f8,0x7ffb642e4708,0x7ffb642e4718
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9856674635007765046,11442494883270194439,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae030b7134568ed8dcd3d659360f98c6ef5715f1e70e22d30b6bf50fc49fdf79.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb642e46f8,0x7ffb642e4708,0x7ffb642e4718
    3⤵
    PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
270ffce6276205d009da0e92f9cbc049

SHA1
1cfa265820fa229ead334319383374e790fc766f

SHA256
2729b34c29242a9a36b6b6a999adae1bfcbef750fb978367b957adad2bb0b418

SHA512
e3e361cf9b31099ce10093d96d51e8152130f8f734148a0cf4ee2994bd4ee4f3acfce8100252b814097197dd9226dcb3109430419832307e2518fd93fba46662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d87683564213fe150ce3500966f462cc

SHA1
b23fea2319929d27c910a436ebaefe6bd93c3906

SHA256
87a8b6873db04e48b817d21f48a7f4b7ac75cd6d90c9af70ad057f7ddc6980b6

SHA512
0c766409fa8454054f0ffe717b58b3a21a13a22f3e5bf425a10350e91347578884f77ffa4083996ff4a419a7b645d67df713b5a8282e80a8657cd6c9a0c0407e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8284e86e475cb2741e643f0e67eaded3

SHA1
5316f73c1d8adb1a317a328e5b0f85c7844d8c27

SHA256
5ad63b4e046d8231b3b650fb50671ac875da3024fa0de860a27679c3e9d58ac2

SHA512
105428806a4b028145117c49af87f7897f58ef830e5bf4abe2f7219f221fe89231666ae89577e33b18e4cfba2abef4c1dfd1eb6260b26c58e248d7b6ac8ad27d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
379e9acf9ad94afa1e5074ab5be55c23

SHA1
619569c4ed7f8039c13262e6c0694612a225c1f7

SHA256
f7256455e5e4886590426e8e6264533b937350bc5abfebaba6996eceb62ffbd1

SHA512
482c6979d1d47e15b69857f0a85c419af8d1f86baba1daa3a7d1ca772693afe0624139c8460aedb56d4e067545cc94e1c7420215066dad63fdc827cbdd972cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4bb67f1abe6020796535f814d5c80aeb

SHA1
2ed9211ac4c6a368415b774f55cdcfd92a380983

SHA256
8fa5c1b36c378a53a606c14edb82db68afbb1621f01f77888fe2a8d46276fabe

SHA512
0cc4b2dddb1401d098ffadee87a35fee303233bbfd153fc129d881b330a1ca6b1313f2eb74ec28e6aef8f1c394208719cd2bb3174ea76b6d6f6286ebe82bee24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c719.TMP

Filesize
371B

MD5
442474660f5a3ca85f46c7875c47e46f

SHA1
df903f3d837cedc4da885799fc23c7af30ec0479

SHA256
78b218521926e10ed5f44bf063d7c025331c6101acec2aa182eea5cd35bf714f

SHA512
41d663c461100b54e496fd680a986a0213ff48a0d532759f9814db9c93cbd172de17e61b7152f4cdc4eca08069d130e49b4f6aada255b8d7fa0dd1296422f5c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa0f5fa98f45e6191dbf76915032b410

SHA1
c58e2ede1833645bde71a88c70e6fdc5448b0f41

SHA256
95196af11848193809c01c066afc5455a9b52874b2d2e615257b21c04c76469d

SHA512
adef0ff86e652d69870fca022c27040e9475cac63aa1fa6314542420e5a34964ea79b404f1be05f4ebbcf41112ca63611f9e546a937511f23c158ccfc04ad624

Download Submit