7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50.exe
Size

245KB
MD5

27dfd8479a0a81e4761bba817088d843
SHA1

f28969e5d78529cc72569cc134fdf122b2e43f4c
SHA256

7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50
SHA512

d7306af943e66d45506dc41c0a21c98d7de2b40c71eebed15649a810c3b1598de953416372dda26d003d009bab2dfd9ad0dfda2d3a9aec83752c5453d9fa467b
SSDEEP

3072:Kq9AnSZRBJZgz/YrB47l9aQeKRkxk+Enl59ZJ4R+OYJ:KlnSZRBJZgz/YN4h9/RP/nzJ4RB

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
3936	msedge.exe
3936	msedge.exe
1044	identity_helper.exe
1044	identity_helper.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3936	1680	7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50.exe	94
PID 1680 wrote to memory of 3936	1680	7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50.exe	94
PID 3936 wrote to memory of 384	3936	msedge.exe	95
PID 3936 wrote to memory of 384	3936	msedge.exe	95
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 900	3936	msedge.exe	96
PID 3936 wrote to memory of 1224	3936	msedge.exe	97
PID 3936 wrote to memory of 1224	3936	msedge.exe	97
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98
PID 3936 wrote to memory of 3864	3936	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50.exe
"C:\Users\Admin\AppData\Local\Temp\7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaeef846f8,0x7ffaeef84708,0x7ffaeef84718
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10865354649685220074,18444514288911157559,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7e12005953925704554d7b0851b541879bc51d64b3afc0c00ed4dced2a47be50.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaeef846f8,0x7ffaeef84708,0x7ffaeef84718
    3⤵
    PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
e476e6b1eb17ccac46b775cb96be895c

SHA1
f3664d75929dbd730e08c36e50385733eb3323ae

SHA256
8020ffbf8ce14cdafca64c9ec476fbbc887d29b51858bd8d6c5cc0b3a2f4b9f0

SHA512
74907cae222d414aa0d6e460d7432a96d239ac4326e45851a4cbc1a1ed87a5d478d5843badd57ca11e2df92241bbd360b06bb26fc6d2238938331f2adc7cbe96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6eee8ec9b9da31e697cf3927bd8132f5

SHA1
5bfa13510e7a41aa4f79fc40d6b6aafff8f2c656

SHA256
9cd2ab604efb36842be951cb7c21c64fdc0f2f68744789ac827ad842e52f8f96

SHA512
b1bce190861c20f02577c5c57f53bd21a16b355bee716655d697cbbce17a6c34c32345b11542f356290032cd1deccbf3bfd76c0e59637ecf49d1e9bcb5271531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae0a6821792a3c777734cd1359db3c18

SHA1
33e1c8622ad8de5951c9cd2781f7e14aa9b86cb9

SHA256
f1fea5ea1c19f9966f5973171fea342dbb647d956db07681e785a2d76d97d8eb

SHA512
7df0b84d2fae67b63680f546f1f3e4c46920c472d8fdbe51b19bb2609a149e3f4afa8ba4c161f5f74be12b628b3b1d62d9735977d32cda14c384e633fbba2430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d4aaad2d87b5c91ed25e701fe1564b8

SHA1
31091c083fe0c132a6743d0511f682fa0789fe98

SHA256
4b6afe01209941249731f3b580fe73e6175f0cf63cac54712aab55b228d59501

SHA512
3c4edb64ce1f0fa6ddfe2974e3bf3d0ca8fc8ac4ea50c0f368bb673fb142a6b07d2ae2033f7a49484b48697bd51749ac2b44e6e3dd0e8dfa5bb0bc7c415d75e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
605f0ad367d8e291013d98bff3f7a32a

SHA1
5d8eb2dd3143ef59ad93f58decfee4bcaa228366

SHA256
0167b68d73b75149e5ff5a14089fd7a2d1ea4cbff6183312ccd163da9abae300

SHA512
62ff6aa4f963bb1cf16edcfa9b9cbe7746b26df6a68da3c31d55792aa84b0bbdedba18716bff920e461f8d6d937b1a489cfb279e78d9d32188fb5cdeea657c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e85c.TMP

Filesize
367B

MD5
9c10cba9474c3e270c5b0bb7d42f1e15

SHA1
86d5e59b290b6f07c19771fd22987e9348e12fb0

SHA256
745c432e19c3568f9d7819dde386ad77abfcf7b7b6e21381e7d6a30f86654dc7

SHA512
b7f61de963937dbd8be5f4dda6aabfe9c7bfb210f6d820db45566f3bb7baa5b49526de1b29c6eeedde0c777da8738f61405db1c970e3c32c86cc06da6ff63ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
709b85bb8299f760ec638733900566f7

SHA1
35e3374a667fe258ad2bd463338be2979c47a85d

SHA256
c08e6d8b7c90cb8cd572df2e3fc498c3719861032bdcbcf1726679d9710e2cc4

SHA512
c22b26ae6cfaec01dcb9f646017e136e6729c842ac8bdaf36f0e5f4c19e4736eac7bd1d5598ae5b25eaa225830ac80fc9cfc1584c17f7563ab6b7c31f76a9c5d

Download Submit