hxxp://accesomx-renovar[.]mystrikingly[.]com/

Resubmissions

14/08/2024, 19:48

240814-yjgygswaqq 6

14/08/2024, 19:45

240814-ygm2qa1alh 6

Analysis

max time kernel
174s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://accesomx-renovar.mystrikingly.com/

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	api.keen.io
52	api.keen.io

Detected potential entity reuse from brand microsoft.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4400	msedge.exe
4400	msedge.exe
3656	identity_helper.exe
3656	identity_helper.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3520	4400	msedge.exe	84
PID 4400 wrote to memory of 3520	4400	msedge.exe	84
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4792	4400	msedge.exe	85
PID 4400 wrote to memory of 4840	4400	msedge.exe	86
PID 4400 wrote to memory of 4840	4400	msedge.exe	86
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87
PID 4400 wrote to memory of 4500	4400	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://accesomx-renovar.mystrikingly.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f4718
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8145922622200742765,1257771723207754130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
bb4b1a630285b1c07af33d45200af08c

SHA1
ca2d48541caf5fcfb208f0e9455fa1365dc16269

SHA256
fd507fa940fc90389ddf6a8d6e705b90a33927b061455c25ea39872f03337f66

SHA512
2d24f536fefce75a94f5b2d0d2bfd535098d7fb14c6449cf833e3e3581790de30f0efabfbe4eeec73c41cee5bbace994fa71d3dcdd6a0a3263bd14baa75c6bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4dd2d51817a7601abf315e1d33e6215f

SHA1
3303ec95093f667ceb81934cecfc456a9f369ac7

SHA256
4b9f8931f34262d684d1daae395f0b2e30fae3a43ef94adc010cc3c86ba505a2

SHA512
614fbef7b30b2c740e5ffb2317f10efe818557b29a976a9b975e1f63919c06a4d9a6cf01264737027810a016e06061f73f0c31e20baad3a8cbff55e0de1a2759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2c5feacc31734fec39ac87744f72afc

SHA1
a91f6950d77c81c7d2d615e2276940301cbb2193

SHA256
d2f48653a1cf6281ade952dc825906bb23c19717a95a26ca9c71eb3f23d14425

SHA512
0350ba253d237b8a171513420191086b90153f363c45be947d9b5dff5159379f91441774018439c7df6d08498ef92de89a9c77a9ce14fcb68a702c39a5fc5356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
79a1d8785d09ea60432f026d85f54a5f

SHA1
109f84c6b96753e71b53e43baf61cac1c40691a1

SHA256
96e0f7133c8fd05650e5f495058ae53e878b13e83320640ed0fe6ad37e9319e0

SHA512
91973a388aff90a71bd67952fc3034585129dd9b1dad2b898abfb16eba5f62bd2a6d9dff13259287204f66556983671b5d50d0c02e7793e8133b7c08c4df1d0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9780ed745cd8e83a6dd7ccc044f78914

SHA1
fddbeb2b879321fdbccb93c0df86833641e139ad

SHA256
6272e64b4be5a9d89a79dab87342c5711e35d977a5b9ecbe0db444ee2e419ee3

SHA512
c1463e28093acd1b50e4a0be988b4c92f594094c77453334a06a43cee32fe120f69db5eaf049c517597e0ea9bdd37e966d65dcb0454f58e6256f8441548f71a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d973e5c0c8bc2041d7b4277daf0921d

SHA1
2f6704b6929eb4bed92a5e6540b9d408a6d9facd

SHA256
3239954cd6dca143c1a72df6d30ee2259b9c53d1363f105de3bf213d7b5f85c4

SHA512
f3a97404c7b8e12cac570f02f6e73f3571335b926b1ee5060d2ca471fd34c2b3b4914527f7880a6eaf6505f63d8acfa8f1a2852143f3b8aea550a4f0e9521716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db5c.TMP

Filesize
1KB

MD5
0584db7b17d69d949186f5eb55a05757

SHA1
a2ebe09f8c000c2ede296013027d8d84726e2d17

SHA256
970dbc2b02befb418ce814c0abdc48f5634933ac6109482d153957ab3210d5c2

SHA512
7f58eeae0218f4fcc4c68e828f6529582ef4ae56754e12ffb059bb88f26effc03d9e54806a9e8f7b60dee93596268bbe1dcf3114df7a7d62a308276ef6f38c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a87e0b15cb84f4ebb471040f785fb9f8

SHA1
54012a54c34705c5afb4c7fb4028f9dd952c698d

SHA256
c1290d449092462e8b335fcc8d6a400e930c5924f267622b4e91dac14ee24571

SHA512
dd3bbc9e999bbbb8c9477e0305771e1fbaa74ec49427e2ce1066be9b222b8af29156f6042be12effe39bc64d710207a01124f6b9e012cebedfbd8d4260ac9dcb

Download Submit