hxxps://getintopc[.]com/softwares/3d-visualization/adobe-illustrator-2024-free-download/

Analysis

max time kernel
58s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getintopc.com/softwares/3d-visualization/adobe-illustrator-2024-free-download/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
640	msedge.exe
640	msedge.exe
3284	identity_helper.exe
3284	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3660	640	msedge.exe	82
PID 640 wrote to memory of 3660	640	msedge.exe	82
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 3384	640	msedge.exe	83
PID 640 wrote to memory of 1392	640	msedge.exe	84
PID 640 wrote to memory of 1392	640	msedge.exe	84
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85
PID 640 wrote to memory of 3968	640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getintopc.com/softwares/3d-visualization/adobe-illustrator-2024-free-download/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87df646f8,0x7ff87df64708,0x7ff87df64718
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1464 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6250465706154971773,14491292643399849366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
1848dae5bff72f1fe7739d6bc274e896

SHA1
e3c6bfdc237c75c1c0f1e54a1ef5aa53c522dd07

SHA256
b43d1e866624667b6c4e20b013fb1127f6a6b4b22ae5292f8955ec4f84d8d368

SHA512
2312bdcab7f2dbd058fba608b4ff34379d38d2caf8c8458f0350a9afc446a8194933cfcd5fcf461c811185dc50dbd1e61155189853e111af974b170e69fa4732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1f33315e69f171c3b4033f9a50519dcb

SHA1
ff6db1452e9cc72cb0513a974a0a66cf99803136

SHA256
80a09dfb65dd1db6db0cc29911a98379f68a997947473cbcc0d875c9ab87a585

SHA512
03f6becc0cc5ee01745b32ef574b75f93d883274008deeb4e57a5b77bbf24e0ce27920ae44dea62c850c3db59fdd25d276b72ca73504d1fdb7b66c038f8b8e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eef5a337467d85b706cee60b04c7f9e0

SHA1
2ac66ca9cab278073b48fe5ace7812a4e1fa84a6

SHA256
48405cb162f47f5060e9943ba8294b368f4ce30c261a264532a91cda1e03430e

SHA512
e4f38410c73bacfc86fb51d8ac360f929522b2b125f0be9f2bda32071afeb3defdb14a4e32a7d927c50306c3527dda95e683d0720078bc607720b8eccd3180bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3f64711c6bd5fb180856a2c87726917

SHA1
d2116a66f4bf23a6e48da8919aff9cc9d2bd22f1

SHA256
9ab4ade7bbb20a1d615f684fc29beab82a71daf6d072e96e37a9f1850afe0d62

SHA512
e9769e6b07ce7c340633951c149ae1598fb6bc0e12bc39e565085c2bf8cbca6f5a34b0ea7e05f757e69d7282a1e191ea8b152fcbbd12914919c465f746fd7237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3387d974cd2ae2d1a8afd053a53ca15d

SHA1
aff1e14930d11e1e8d9eb9cfba57bd0eb466e209

SHA256
7d6a9174429677cd0bbfb6715346513e28b5a60e06c02deb6e22defdb58a98eb

SHA512
d151b3342d0388f6939a870189dc9bea351275ff020d6d1e83c7f641a68b6ce9ea544ff1ab9d36c9d068d74066346f602ab4dcb85ee2fb47267ac0974c308a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3a1932b2b95935904929646a45e20fa0

SHA1
a36a0653620c910fcd07598f484517ea4de6a8a9

SHA256
8597d9efd3e4dab5763c9b102d4c67511ae836d2e9c333a2c88c1c4957793fd9

SHA512
584c3afaf2b1ed7b63e0c4e6798d613460a4909f0f36e761f5aae8108efed031e062926440c18bfd62ae648abe1b3c3a5c35f2141650b4f600a080761026518c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ecd3be9bad6ce71d91dfeb95166af61c

SHA1
b12485108e08f317d5bed74fba0e13f1a1f9a373

SHA256
7c1089fbbaa4ea3ed38de3d537fb6cfd932a556be47ad6e680b86eade13ec0de

SHA512
43a57e290741986e1e2f9a26096040ebec147cbaea2e23bf5f11c3f8d953becac3c321ac74925b3142f1c2916be8830e9e51bd7503033e7028bbd8770a1fd322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801df.TMP

Filesize
1KB

MD5
09d8bf09831069b09a5a1d343f926535

SHA1
33d813314d245201b9c6549bfb2ecbaf579bb1ab

SHA256
ecfdbca7f6f0b085842c270a5f843df0aba4d4e884795048d7f883bbf09b421f

SHA512
5c1d93fb669c958d46b14c745d7eadb80964d7e324a8ac39c9b75dbabeabd558f02177d0dd136e39eeb37a6979914076af27d536a5863141c426878a9c8db5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b919f2abe429414409801d6fe06d9af

SHA1
15a96d783f332a9828628b02b10d243d0f5d2382

SHA256
71c0483811cb1d5bfc4b070d8a5c8a286b8d632a23e911583de6956c790ff763

SHA512
c1315beb2dac92270cf9d1c79738cfacd6d2edd54c547bbbb3e27c1a2174f8f0542419908e27a7d2b9e54fe813b2f9b2bdc22a3970fe1c64e6d8192d5d1efe68

Download Submit