c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b.exe
Size

164KB
MD5

937852c6476f290145616d53ae9533ad
SHA1

316acd4a83446bbe9fa1797e0172f56d07619325
SHA256

c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b
SHA512

22ff250cf35103d89ff994adb1346730670db8c7d72afbc475e4e06eb6379e2c853980d6aa792ac6b35a2e4e1b78f9ce93c1434a4c6e05f4840b01858fc844e0
SSDEEP

3072:/IayNSZALgMbJDMN1BOeR8UHHZHoz45gJHJfg6VRBfF:/IRZ9DOB1BVLGg6VR

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
2728	msedge.exe
2728	msedge.exe
2016	identity_helper.exe
2016	identity_helper.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2728	1456	c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b.exe	93
PID 1456 wrote to memory of 2728	1456	c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b.exe	93
PID 2728 wrote to memory of 4464	2728	msedge.exe	94
PID 2728 wrote to memory of 4464	2728	msedge.exe	94
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3648	2728	msedge.exe	95
PID 2728 wrote to memory of 3944	2728	msedge.exe	96
PID 2728 wrote to memory of 3944	2728	msedge.exe	96
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97
PID 2728 wrote to memory of 508	2728	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b.exe
"C:\Users\Admin\AppData\Local\Temp\c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff462a46f8,0x7fff462a4708,0x7fff462a4718
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6950248677387180347,2871686955819767298,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3484 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=c6e22b477310b6daac6481cd028104d8f434d10a66c015e98e8ec4ee8574179b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff462a46f8,0x7fff462a4708,0x7fff462a4718
    3⤵
    PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
4b014139b29a64769767bc73f575f1fc

SHA1
c53eba762ee1a7cdb1fa4cb60bd5573c13497fbe

SHA256
9a7a7ae890f53a1de62ab9415abd931bb8cebb528fbdc2271974805dda501cf8

SHA512
81010b117c5194fc9d22dd0045224033bf69810f48ec6cb45edcfac44ae36aca6dafc45b5ebfa702815586922fea213625da9129248fc36d2b34adf25726db16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b46ec282b99d3423e61824db958fc8fd

SHA1
10aac5cccd48aec31675f0912784e144f3af97c6

SHA256
b77ce4db3cef9743e99c84999f832c0d541fd0f83b839b1de38e31f98ec18829

SHA512
824c4737151d4134d2f71689e84a4da8cc2119c495ef1b6799c0933f696f6c2ebe43ad667948c258fc6a30876166074a9f4d89d4e25e1dedfd00125c5da9afcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef6a1c914c507b17d7f8ccb72a938e73

SHA1
bc9dae9118c192771463794ced810d0bf9f5ae85

SHA256
144e947325e47351e60ce80cf6b389a9a8a7056e8dbfb806706390b835dd9134

SHA512
19881ee6345da1d8a27322214377965bdc9370a8c1bb43105d62395f9c365e0527c8d68ec6687e81117307b86d30e206d89c1b40b6c4aaa3723eaf01e168a057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ff7288f3c9ed22170e4b712716e4dcf

SHA1
16ce0116b8b6472eb35ba544eb19e037474313d4

SHA256
5c075585d211742b26ba7a2288c62eedebeb3d82e28a70954f04454c44b33d91

SHA512
4a6ef27c3470187097783e74d5e1fbdb4f72b07642be19f057a43eca96ce19b4a8fb45814c307c61630b2ebe9287c8547ef10d0b8190f66cece70f99b9187085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
dbc3a692cd2733719dca63be94ef2f46

SHA1
047cb39661184c4f2022c8c75a5a0630b4f1c31d

SHA256
5123bba34628c1e4e131c0cb49caada5f7c94670295e85b832df230fd3c27499

SHA512
69395a3d89c966128a94b13bfe934a5972cf20d85e8b05c68b06a49a23c0dc422a259e991fa3f20adc0441b56425010e8e9a9e8304fab1fd7a59e40ffd4e72e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57abb1.TMP

Filesize
371B

MD5
2ddf56b792fbb4b05a08b3f74b0515b9

SHA1
449beed53eb18640949ee5a126b12f53149bab20

SHA256
4c7218dfd14850bad8c0127bcec4228aecdc51bbce64ee64bedb3c49273571ef

SHA512
7339a2cd7c80a4437bc9f2525c75d8ea6323f1b13082299533cd88936b0178e28fa24205aeb279ba156e4390da84b559c1fdc52edb43b55800141dc385c740f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aae60cfaab0e2cabeeb1f79d66cff333

SHA1
0c77a0a1737b60fc298f2b1ea43c8d3c87648e5d

SHA256
2bcc7fd7520bfd5a93e6cc0102476b7a59a54f1d46827377fdb4a8f1eaa5e849

SHA512
4ebfd3fbb91944dbe0a8778b062f5aefb793a44f981ed1f9bb82b2d7694cde78b03d292d37f025c5c2169c47a6eec816b94e2ee36304e5bc55276b6c6a348576

Download Submit