1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea.exe
Size

164KB
MD5

726eb6c565f4b8cd832c26ccd99e57bd
SHA1

3402366e99184d1eef72a31d9cd91e67cb3ae4b7
SHA256

1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea
SHA512

8aa82fa60b1ada5f7c00bdbb5f8c5a162c00ae6f897fd7432d645e43fafe8c296e241fb2e37ba839021456c61a7fe66e520969488c95a439801cfc3fc5e5335f
SSDEEP

3072:4pb2xcb2M1CL4BnjYX3ylyQ6OnRF7Gr3k+xU2j:4gcbYinkXcyQ6OnR03+2

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
4480	msedge.exe
4480	msedge.exe
3860	identity_helper.exe
3860	identity_helper.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4480	1316	1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea.exe	95
PID 1316 wrote to memory of 4480	1316	1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea.exe	95
PID 4480 wrote to memory of 4256	4480	msedge.exe	96
PID 4480 wrote to memory of 4256	4480	msedge.exe	96
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3580	4480	msedge.exe	97
PID 4480 wrote to memory of 3832	4480	msedge.exe	98
PID 4480 wrote to memory of 3832	4480	msedge.exe	98
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99
PID 4480 wrote to memory of 4148	4480	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea.exe
"C:\Users\Admin\AppData\Local\Temp\1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9180646f8,0x7ff918064708,0x7ff918064718
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 /prefetch:8
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2332,10730327829353162214,13157711049800473242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1e13aaa4b61d49d2d47fed4845d4bbcb0c8e93d51132c88137a6df47b10cf2ea.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9180646f8,0x7ff918064708,0x7ff918064718
    3⤵
    PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
138ff0264c789d2ab4ca98ba5d15a611

SHA1
6b67f6516efc033416e270065d655ed4c01e8d56

SHA256
79c54baf7b58605bb1e6e3bc319c66b9df8ae6c7d9f6ef939243dc4442627ede

SHA512
337def6d2c11889242c790eb1312be5236c57a60a320934aa319edc9b957c81a94435c22b1be26044fc784a7b54a43f56f12b0fad261249e855c3344a78d91f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8ed01d4f63eeb0927f2053bb2a1602c

SHA1
d38852fed20d8aab6dce88349dc76b3202d99930

SHA256
2ccd85a4071283b02511af0a16404a762d5f037c8ac157dde4c2fa40c3d3e6fa

SHA512
e463955fce4f3ef004111dd58abff980ac2a7f32bd7a57dc3af01b339153ab0143951c0fa5902f8439cb683d6bc0d7dfb86aebd46d179533cc27e39bcfb2579c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
014fd21ca2bcce060db65289b06066bf

SHA1
0e4aa5e2e19ca1dd38ff16a0de13889d4db14cf6

SHA256
07190b617266ac70efe8b7587431477d5bcb07a547b47f68ec20b826a42477e1

SHA512
27adba3d98b553995e52bb81ae3ef2c542e7a4caced76f8d5438577243d18d276d517fd51b1ff89fe466338185ea9c23fc7029aca0d434c3cb5eec143c9c224b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec33726edba25dae4302c5af1a98add9

SHA1
46952a3104043cf16724b400eae7900204211267

SHA256
9197fcbe5df50b9964f8e784fd6cfdefaca31dc4678e65d695636db6e96dd94c

SHA512
c4b64f03634447c0a5a852f69453f9d6a9330ba6f150aee59da39628cc73ddaddcb7bd93b8badec6db9cd1a7245b2691bcc7b4809e26ee0111ce11f8da7820ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a99dfddd5901b9cdb9830d465fe3a604

SHA1
8d20bd501822b58603fa10ba9ace8d7b2e5da3f4

SHA256
5ba20baabbc4a9d5fe1021a7fdb564be0594ceff1c81016bb09b82e1ac983f7a

SHA512
ca08a1ac4b44a74c96c992e0aa36d2343e9e1a48e18e8d8e9f9c12099dbfc9dfab327de55d4e073eef04ac9608be7da5a46b462e66754468124af68c478d3096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bf77.TMP

Filesize
371B

MD5
d617ee383a4b95eac9d1065ffa8e94f5

SHA1
f98215d5959393f52c96ddab6a1004258eda2cb7

SHA256
62247ea3bd90e4f259225478e6ad40ce377bab309ad9690014a824ad5baae9f2

SHA512
80c65da509189a183ec2e1afbb9d11066efad7b8c593a8c8eb243976494ca8c92bcc0494088af868c1e2094349970a5de77d5070d606f9f698b17557160283eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
51819d529aa11e5b6d50ddb90b690aeb

SHA1
92a2fbeba9963810ee30810689fbf12e4b1b36a7

SHA256
2bbcf953c59401b4cbb7ca0767935d50323a1d3caa558c06478abace2c82c11f

SHA512
eadbd3178c83adc9a415582553d1f088260bc4f7cb1531e04b839a938283f4fdf9dc3a6951b7b0fc2d61e5ed7ccbebf4b0eed7766837b9a4dbca072190c8bc01

Download Submit