hxxps://api2[.]fattureincloud[.]it/private/3jq8ga0raag6hl5sw0oth7ywqwv2y36t/issued_document_attachment/c26b138631477a280fb7ca74eeff02e8

Analysis

max time kernel
132s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://api2.fattureincloud.it/private/3jq8ga0raag6hl5sw0oth7ywqwv2y36t/issued_document_attachment/c26b138631477a280fb7ca74eeff02e8

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
109	ipapi.co
110	ipapi.co

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3124	msedge.exe
3124	msedge.exe
2944	identity_helper.exe
2944	identity_helper.exe
2944	identity_helper.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 3236	3124	msedge.exe	83
PID 3124 wrote to memory of 3236	3124	msedge.exe	83
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3696	3124	msedge.exe	84
PID 3124 wrote to memory of 3192	3124	msedge.exe	85
PID 3124 wrote to memory of 3192	3124	msedge.exe	85
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86
PID 3124 wrote to memory of 3508	3124	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api2.fattureincloud.it/private/3jq8ga0raag6hl5sw0oth7ywqwv2y36t/issued_document_attachment/c26b138631477a280fb7ca74eeff02e8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa80746f8,0x7fffa8074708,0x7fffa8074718
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5244 /prefetch:6
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16107841266141209568,2675905706006059169,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
3c9880e19ef2444af1b184fc474ab4c3

SHA1
ac1e63e7edf7a6052d6eedb132fd5db4bd983624

SHA256
ee55fb46df610a99c649bd4d46b8f2727937440136dec18e2be97cb22e16a296

SHA512
399e75a562d1ed62caf69fe4662e84c10cd01daf4dff8698a81bf84cced3297fdf27ddd535ff1aaa4ff2e3241f88d3d228972213992145f9b330ee931410002e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
02d6a37e2a6fbeb758771a1ea75a6275

SHA1
8fb45ab6b5bd712bec40f5dd53da6ad31b2f89fd

SHA256
1c8ff61996b8239ba6deaaf309532fcdc502abf49a42395a6f6bdebebbae5132

SHA512
8a90a4a713105454647ec06a574676719c16d9d410c89006e28d38c14648f50672397a83d7147a176407fabc4abe2b0a4298ec1816276d908d9647fbc52bf5cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
88bf3c042bf746530f6680dd975e882c

SHA1
5ed21fb2c76073be73af089c9a25cf0c16317704

SHA256
6168ae91ccb07a1013bcdfdff26e0aa95d2d0c7bf836b297e007998f3717055c

SHA512
813b70ebb90170c88eb833a325cb55bef4a69922a324c5a44247c131365056b0e80b4aa7d2052cf3e5803233463c3bfefb0b9025899ae8fb54a910a570d1f7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3dce7aa945f48c0fb70da1fb8a3a3bde

SHA1
6981236769c587cf91aee3124b71f4c4f918c054

SHA256
ac153cab6118eeb055413fe2ac45a2e26589d35baaa66e9bb370e4ebc4d1be9a

SHA512
95ca93c4ea54e838864f470e72e311bfc1d4748236ff180b3779e702fb071a1800dd6f68057847f427eb24f711ea7459010bbee25adda16e3ffd8c7e7754f5e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
05d5578cbe95fad862e0607085cf2399

SHA1
0969cf7a0d0813f727d5628e7bf6c24cb5c79eef

SHA256
ce3885e7128721b8d62d91344d4845fa95e6512d56f4c63d13dcd4f6fad07d98

SHA512
9cd7ed040c3699fa87e916081afadc274040ec0945530c04b7b42b6dfa3a1e0d18fb84f3239369338221f9f8670674970d56f7d8c13d7534e439f0fae8c2d4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69453e06a90b4bfe2d42d5f6fbb141a5

SHA1
37e240267c5fe6b1cc77bde91ddcf7fa76aa31ec

SHA256
94807af6da297c194540d15470f3497ed38600f9fd2bfbbd1348b44ec32af588

SHA512
58ed7c7e92a491a4c968bd3ca81270615761c5e89f0b6ef90e47ba553e5da459369f5deafc038bdf00442ad3040db4862266ffbbee6c1ca0ba8f7fa4b35668d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
0ebeefb638e73ee96b66131e2743a58b

SHA1
114eb5451e2fd2264e56dba009ee5ae51593efa5

SHA256
feeeb56ec28565c9fe9eac7b2ed920e3eb75b5a48e77596803b4386049e1c5c8

SHA512
6186eed439f423eeec2025d0b7e4d3f73d778cb648c8059a70c8b704870107f6c3248318bfa98f1a1b6c4112bd4bdbcd8c8f165e648e404f8529773c1621bb35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c16b.TMP

Filesize
705B

MD5
8da19dd3fa2c4adccb4631ade1828167

SHA1
78c6203b06ca28f653a7feca17359674cfe84694

SHA256
dce09d2266c95265611e1071e47445298dda58245a43182f82e27991504c6005

SHA512
10686bca719a0c742ad221aef959af8578dbabf39092acd0be1b977f4c1ab3d017355fa61e3bff616934765748a1930e77d20d1a3c66839c7e4f789c3c1d2a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da8dcdac205f5e5057818a3584c23ad4

SHA1
42bc2eb542387c741bf800fad5985cacb060a41a

SHA256
7e363e969c291e49bf9c25d44080666ce67bf6dbad83794a94ea8c0ab6d812e1

SHA512
168dc3fe5cd130138aa09aa74fad290b0d17bca264f8cea4b24aa7a54cc0e9c8f591dcd13a25d24a630a7748af0d1a42ba56287075e055c83489f545e1f4a05d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit