02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782.exe
Size

164KB
MD5

7d65689a3814bff175592146867d0544
SHA1

b2d9b81bf05efcdeeb30f8c899de25d02fec2d10
SHA256

02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782
SHA512

85b0dbf90848ed925454a9e07b3d596cd4ce4148130d0e16c19a2747fd4efafc0f93b218e201dda4ee92ac46659c8642ae700f9be3a3a5b6d2ab86edfed9fc52
SSDEEP

3072:2aoMxkDcHDlYq1fMpNm63q8TRsUyKKyH5R3Zr:+M2wjtWNPa2sHwxZ

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4996	msedge.exe
4996	msedge.exe
1788	identity_helper.exe
1788	identity_helper.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4996	4820	02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782.exe	95
PID 4820 wrote to memory of 4996	4820	02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782.exe	95
PID 4996 wrote to memory of 2392	4996	msedge.exe	96
PID 4996 wrote to memory of 2392	4996	msedge.exe	96
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 1944	4996	msedge.exe	97
PID 4996 wrote to memory of 4464	4996	msedge.exe	98
PID 4996 wrote to memory of 4464	4996	msedge.exe	98
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99
PID 4996 wrote to memory of 2748	4996	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782.exe
"C:\Users\Admin\AppData\Local\Temp\02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde63646f8,0x7ffde6364708,0x7ffde6364718
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9173189367455698506,11133547761756160125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=02fac80d97365cd39c71f7bf109b4e3fcc72894288377a4d9af079fc60718782.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffde63646f8,0x7ffde6364708,0x7ffde6364718
    3⤵
    PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8c3095db0288a5bfb0e81cca017734ba

SHA1
bae1642792de5929750259e668f48e659bc0b148

SHA256
ff9a6b40e054f99c8f57347e1c016a41cfb7636c53fc5d4de6887f0412065c43

SHA512
08decefa4011ed6f7c00a4b36e71d955079e2f6f96b04f4bc1a6811a5b381e4c6c21c50e9e64bcd1b7740693da516cdb2a4b2f6cef0590a74853693c450a24aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
961c66d8fa9aa96ab457be20edbc0820

SHA1
f6a1328f49b757d328bba7ee64a7b61ec1a019a8

SHA256
2bc3d47a5af0487fcf69d042b0fa5518cf227789a0c12c72b13636596f9dc368

SHA512
de3ab964ed35d1c729ffc2ebfb91ddcb7ff18c7826a09fb18755c572ee2cf131e2476cf33cc06cfb05f6b4ba6c47484f4c3ab40845552ccc1e964d0168bfeabf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cf395e81eea6c75b5cd4b08739af993

SHA1
328ead71ebc2bf846fb00a55eda882a1a4990070

SHA256
d2c6d25a97e415db7da4b306da3c710f434e6d688fba4a6d106487593b0c02e2

SHA512
a549946a8802666548d92c0a562cf5a64e5cbf913e099d7a9a9abb2a353dc618207f8bed36e6fb9d3c03cba412e00427b8ccb95958d7cb5c7f5c90b820dca44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c84a6c01a0d8110a21fffde5048529a3

SHA1
baa2b471d7da5d22a6e67ac6fdcea7ef3df9b111

SHA256
b6238908a94a1d75f816ba6d217ac7452293f71d3576d386591ed9568a4faf70

SHA512
194aadb28c5ad2fb5c7342c07bb29869631cef5f38890c8b95a1d981d1376a99bd7bc4989ecfaecaeee586249880cb2424ccb6020d3857b9e0dc0630f4087b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
2d296d9dbbc1c626d7b289a92a661151

SHA1
5ce6c7df4e5e33ff27466a498f1171bdeb2506c7

SHA256
34232bf2f70b0e21456e8419158fce807b636a41ef578e79baf07704d5a0eac8

SHA512
9a76bac8419b71f53cd92c21b9c2f24d03c2a4e32fdbfd0ba96fea15340bc0023d5e2469056daffc2a69303559f8aff1ce472a5874ff7a384c29aea6fddc05ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b565.TMP

Filesize
371B

MD5
7620869c4bd970e256a538fbcf34da0c

SHA1
e9d462a110df2851c75c916e4a154dcaefaf8058

SHA256
3a16c1eed4b6c5474f6b5033f4a8a0b53e15dbbe1026742b563c8b253e72c60e

SHA512
2786b9d55263c673c007655605e4cfd1be333a906e82f79090bff8fc6dff5e5550b58a69c4330ebc0827b0a2ab57011dd16d391435cbee0cb7efc24d643db036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01b77c8539f187a01ed870b5e25a1a20

SHA1
e8abeb2a744b7d802f17d8ea250095c2984dc5b9

SHA256
0eb48e1fa55dba963fd49cc9f188495f79e3a5ae933a40f9dd305aa93ce908a2

SHA512
f40c1c32a51bec41a53ee8f5f3cf0e57391f48e654f98e60a7cf1116e88c8b7b5a30d0d9247ca2a40abcb31aa22102d712d9603ade1ad6b5bf504d32139d9a13

Download Submit