hxxps://acrobat[.]adobe[.]com/id/urn[:]aaid[:]sc[:]VA6C2[:]f82d3ae5-2bd1-4586-b383-2adf266d628e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:f82d3ae5-2bd1-4586-b383-2adf266d628e

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
432	msedge.exe
432	msedge.exe
1944	identity_helper.exe
1944	identity_helper.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2508	432	msedge.exe	82
PID 432 wrote to memory of 2508	432	msedge.exe	82
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 404	432	msedge.exe	83
PID 432 wrote to memory of 4216	432	msedge.exe	84
PID 432 wrote to memory of 4216	432	msedge.exe	84
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85
PID 432 wrote to memory of 3188	432	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:f82d3ae5-2bd1-4586-b383-2adf266d628e
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dba846f8,0x7ff9dba84708,0x7ff9dba84718
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11827876051908577463,6657855994943384104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
47KB

MD5
a90efb2731f65de5f02949af49c8cce3

SHA1
3a6162b0eb9406a7e6bc88c3e25ec9e93d4caee5

SHA256
af495c0e8906113250c223447749559fd1db504b0fbd79d6be0c970ff60a64be

SHA512
cd94c1697a7b223c8713c07a2cbbf10f8b43ad06e2512327687209e38eaa52ea073b0df9de79333e946d78cc91783a676ebaa3975e56ca891974e0eb28cae748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
28KB

MD5
91e0978bb8954e02b55b6cd9c0f9c2fd

SHA1
2ed21974310de014818a05abb32f094fbfbc05c8

SHA256
35c2538567150075b7ef4a1d5f93ea188ab0e470d094b676b9f7df72b522d21e

SHA512
47b3e483a1b40657c7e67a77fe79cb7029ad9cf612e148e81485eb8d5bdf79ba79dd56f04c54a897c9bd49b9e0268e4b816f2bf13f97f6a40aae771451136e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
2.6MB

MD5
d6bd58d1ca2ee9a53bbc5ebe603170ae

SHA1
a5e24060b12a2ad914973a0362339f54c051d7cf

SHA256
b9295e5ca03e1abcb7e8f2cbe4ebf735eac815efe27ba1902d83fa2fe7b3c89e

SHA512
7499979d180a421d5f4176fb76cbf0e1ee513da85a55679ccb24bb299fe3d2d6005d1471b21b2db410692d246e1edf0a45b08b3c3e5ba173787882fd815fcfcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9d355b198026db3ab3e7e8998e02365d

SHA1
1bc1124e88f8126f70948754e6a44917aceddfc7

SHA256
9879f1e8a1b6ac1b9a0e8d843b200611e1611c33c668409a96e8ae3508eca573

SHA512
da0f3c878b82473b9923b5001de18baacd260468ec4cef8f8fbae0b8c3d4d898b07c99966c39502c677a8a9f9bb9acce214810c1198228f36237711ae6de638a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
b21e9f31d8591edbd0f4a821dc4cd035

SHA1
d5d2de944ed2302d2a8d41e37916837822065fd8

SHA256
588acbfdb5a272d0c54d130484b05433dcbd6fd54252a7671c70727959b2347e

SHA512
6d5829697e814440140f2b449259d484bbddb1a88210f785b13b7fef7d75d394d0b907d644b4b79a2bcdc21a7ff35113dc9d13468777fd8f81f82707416ece6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_acrobat.adobe.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_acrobat.adobe.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
306ca6c227087009008c865b44718e19

SHA1
fcb281a64717cd13d28e428596247b7b28538afa

SHA256
c193207f6589d53e7c5231ab5e0c99f6a2ebfc2b6db573a969e09e2ef8585ece

SHA512
8a5265063c53e1bd5d7398a5813984d642828de01a9dfaa01ffa83238bc6eb272bd76e5f3e765b22f8bc26f243d207837a15814c96ef4909a0cc34a227a3ba11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
311e7c42b9acc000ebb423c651bdf07f

SHA1
05b8f6bbd21b65db82f3bb2f680785a6b0712347

SHA256
b187c25c7636c056f8e84b78c61ad6b6dacecbd430729823548f8899e2c633af

SHA512
9bd4128b79da06ea19fad6d14627a75056c254a88b48897e89b8556686fedd7a9d4062b80275ea37e17855424bb667f7a2e4a92eea7a6f54d51d34837ab642b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66eef7b5f262d5e4340d110a41c05a4d

SHA1
68f06fcf70aab98aae365ff2a1b758e840984213

SHA256
922f3b56f5829c835c169fc564539dc4114ab7ce70ac0534a9dd889e74a75593

SHA512
55ea9d2807cd3a9aa965ed9da46c33805bb7a95b9e41f8c1966680af8a7c698e15464645e57329a4ac3bb01c0b2256b7f3d68dbc45cf1c1125306440c8d247d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6e12a8dc957ddaa023a1b4535b65c956

SHA1
61e44c1b6682273331979e69c3a46ed177d79be3

SHA256
6715b65515911eaec45afd98e40c2387f8a46573560550bf53ce0e1dddf40e36

SHA512
35023535ef57de85064577f656ad9cc1160cad5288188d1b6b7d650803b9a77b150c65eef23ec17e37c1a61b5086aa8ffbb5c14f409fc76cc52dec33555c5924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\05f2c25a-8b76-466e-abc5-c61adb915ed2\index-dir\the-real-index

Filesize
72B

MD5
24e3e47a0099a3c5d69e6725874a83c8

SHA1
603ca4993c82b14930cad2c19361b6a2d13e003a

SHA256
3a946e27ed4e78d2527ca037bb7e842e9c0a5788764c3c759d0a7dcf4457bcac

SHA512
465ccdfe5891de618dc8202c5209ece9031389fc6686a480f14b2c095e6d2bef4ea19c96a583f02cc52257833315c12eb363156431c3dc7efe537fe9ec229a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\05f2c25a-8b76-466e-abc5-c61adb915ed2\index-dir\the-real-index~RFe57fa00.TMP

Filesize
48B

MD5
5f420cb3423090efb1337f23a2c9f3c8

SHA1
1d41c27fa391515652fa5580dfd3be293f134d8e

SHA256
f462bd286a6d68b350facc2573c808515ac8d84e12abc0427082ee06746136d7

SHA512
336cefb0117429a8d2b7408672684df2118e2c786bd1e9dc38833812b0dfed9fd9f1e0fc17b7ec60b51a86945a3f3469d9ab55491e736b8a0e2eb51a6456de57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt

Filesize
129B

MD5
de8f1bb6a8b8fc82f794cd07da865408

SHA1
cefa577168ceb15349a62f366568e8cec79cfdbd

SHA256
ab8a51dc9ee040bd1e82506771410d130cecc29a91978887aeb4477064f9b1bc

SHA512
059ab9d16367368d5d374998eac0d423a3354f96f901c845ab8b8699f4e58189d19a32b7c6a49e1d3e441364c7e7952a218c2c81b33069ecd3be3d6af0cb1233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7b539bde8ca0807396a791d6ee4db1189d0e5380\index.txt

Filesize
123B

MD5
3cf23efb5e3a9f893c6b38a258e28ef2

SHA1
ba85776ac9d640879b09c7080497368a229ab374

SHA256
3906287e519f16c4f93476543de3b4cbc22d8758db28607f4537a09f3f11439e

SHA512
6237423a694251c5f3f63c5707ec270ae160eab5ad875afaff99ac6b7323121c0a37ec0e520f136ff81ca795124a2358f1301b69dd892de96c8784aa24fe22ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3f4b23651642135fc2641310dacf2e5e

SHA1
5985b5a8fc3a46284115160b09ee529b74497294

SHA256
1a758f0e1fc4d1ab20861c25fad03b47ab75ebab1ae74ac54a24786758115ab5

SHA512
27d12a9d901cdffe3613be6ecae4e26c833f7fdf4acddb83c437160aa4b5d04e79ed9c9042315e37df7b72cd0788ab43751e84742ed87a07cbb7bb24c7fef052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f9b2.TMP

Filesize
48B

MD5
4a07ae309a4e55f3fe6873db645566cf

SHA1
61092027dbcb4a9537b8b76dee2552ca5ab25c65

SHA256
8fe7634e8f0578cd6b1a1ec293147c8892cf7c635f810a345d5fe7581d4fde1f

SHA512
87eb878a54729d7d754fb36f45406e24ddfecd79e0d71c3c56b93fc748e512abcb618406156fa85c2bf4db185a3bece9e97b381a3c054749a05b9d1bb9e45881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d2b3bc57885d37775345af06286c473b

SHA1
d00f2840ce14b9bcd2add465d6b533b671c1cf7d

SHA256
6c4686180d5cb4c3b7e6a807c1f2fae9ef0e889ddf65fdfa8be1c30f69222d87

SHA512
54fb75980a44c65e45ce2c71b37cb183841469ca105cd5941553bac9fe51e343c96530c4301ce270612a56e2084060ac9eab18b592c3c423bcf10154f74ee4aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0ab378333dd8d7538bc9e1cbb8091135

SHA1
3c8d838186cb41e0a5403fbb2888636479a1f26d

SHA256
41308c07a05630ce22b0d0144d0cdf229fb533c9ddcdc683c9fa51ad393b6f7e

SHA512
468e9fc872ae102bcbe712ca33d3d857b97b40ad467da9f865c95e6c6e39a07a7408b4266500c2bfa8086d1be46d7c4a0286f2b2d9b1993e07d70b5e347ae05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3424b7036fdee4981d0f1bd47dabc02b

SHA1
477ec408f268a36d339c01c13782733bdd0b45f7

SHA256
26e2b5f6d55415488cbc81e74f451c8f9e927bba457fa4ab46ace72f986979fb

SHA512
1e7a9e5f29679b60ad4de3ccb2ef73d4b58afe9499f57dced229d0f6d42822c2153fafc5759778430ae36c69515f07a5e707a6adf164b7d6b580a3197f16c919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3e208e9219dfe1b42ac8c5bc377c7d87

SHA1
6e8f60aa24f2f14bb69674c312a35726a022906f

SHA256
4589a84cf6639e91ec595fa4b5d3c2ae282c2df25b1f5f7c62bd86ac6d3c9aee

SHA512
3d24267bb7dc0d468f1f77fb2a4ce80974cb302617d329791862f8fa65d675567bc003131743fa57fc42d77bff23ad80ed323b070181e38698571a0914450deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ceba.TMP

Filesize
2KB

MD5
2d5d7ca54b6e6878f95c7cade9b08a41

SHA1
b7ba39b867e2d9f2417b2ef28868ef6a0fba41bb

SHA256
09836e1d020f2b559e18810c83a7496c4792eb0ab5d616818979f682d79f3bb3

SHA512
97c5f0047ec965ce45271fda88cd30d2cf2b33a3f1ba293bbb3fdc5312eb5f94bba2c54b922c521d48273bd7030bfcb496d7c592d01390cc9a87a8c4d5756117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd7922933ac7fb0644c5b00ad02603cc

SHA1
ee28049e7e25fa38375cf115cd69c0a4fc245390

SHA256
c9cc91a9ea069fc0e2922ada01212d7c7d8de3b6b142455d7e51fe9fce87ae6a

SHA512
9136ee4fdbcb0abc88046528963fb181452d3ba097d4f857c7473325a4403b921b3218691c396f145cb9fcd5d1376751be7e23c290565d897ee50cf5c3728a79

Download Submit