hxxps://protect-us[.]mimecast[.]com/s/gKI3CNk2BRT0BAqqi8HHEW

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://protect-us.mimecast.com/s/gKI3CNk2BRT0BAqqi8HHEW

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4088	msedge.exe
4088	msedge.exe
3944	identity_helper.exe
3944	identity_helper.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3832	4088	msedge.exe	83
PID 4088 wrote to memory of 3832	4088	msedge.exe	83
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4648	4088	msedge.exe	84
PID 4088 wrote to memory of 4828	4088	msedge.exe	85
PID 4088 wrote to memory of 4828	4088	msedge.exe	85
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86
PID 4088 wrote to memory of 4688	4088	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://protect-us.mimecast.com/s/gKI3CNk2BRT0BAqqi8HHEW
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fc146f8,0x7ffa1fc14708,0x7ffa1fc14718
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13580781092882899424,18065140255782701913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b3d2f4dd30d8b4a78329f8f03660edf0

SHA1
b4cbbc03d61f5b3c90356345a0956c3a87f638e0

SHA256
15eeefbef55dd8e28ccbe952ce458a36be9d114ff5b2474e652a84c234ee4f5b

SHA512
1ceb820b51929d767e174b55e47277497404aed29541a02b3e7951c0c189300ba89bda04f29af6f105c0b16edcec1df91baab4ea79ae2131b278583fa6006b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
83b74fae26e59d9fb4bffd17ab4dd4fb

SHA1
78a3287841e0dcbbd0eb82884aafb58ec892eedb

SHA256
4cc2d3a5f8ec3163ce46c807fc7fb921e27de8d6ff20fbf2bbea004e39d7f28a

SHA512
307f665e88d693a3a27eff1ff84e80e8748a9b5666270a43d80e1f1db27d9faa6cb2b2ee74d3472ddc69e6f18940ad2272a204e11b8ad850f97dea8c88720cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
189c338173953acf265f490d41e54f40

SHA1
063439315b4c6fc6b0a7edf1bf75b739cba25e3d

SHA256
87397f607e8c23b318565d523af116aed5cfc4d219e917999642b535e966f00b

SHA512
6622e312037346802e6326a2f34e56a43a7d46e047631005f6a8f7905df7ead444eae1a8ba0dc2ae9d3e3131c525e973bb73299c44bce825971aa75500583d4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e1e3bf56be58d3a7cd987f903ce3ad1

SHA1
035c1a8534f1cb44410263bbe63d15a5713d04f7

SHA256
77ec0e977563af54f1a1a9c4c4507ad0169cae20007e64f76f58e030fa72d079

SHA512
edecf162aa50709f1dbfc5bf9d1dfdac55f45abeabc01b36724bed879327e3bc7473386fb5c9dd6fabbdad933043eb8f926560212c5f821e334e1097ee72990c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9cd5d145c24a23983322ac31f0749dba

SHA1
a69d97d5c1d6b5b351ea138fc1593d7c9a1ddb7b

SHA256
a9025583c6ec22848da25a77c9fdc91fc731014d1a5361e8b4e382d127d64181

SHA512
7dfcf0024a925401149c75030ffa4d26465a17b907ce50e612bb34ec8922ae57f23f6a7eedf21da3f810f6277e51d4a309feecd98da54c9aefe44d9962e88328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1b398ede39f42b98c0d85d420faf927

SHA1
79566ec25e24fb0f024895e70cf45548e7aadea4

SHA256
92117410434e18df6ec06220e0e3e3d8e2112f102870780af479408f5ccb3c8a

SHA512
4cea0d29bf423fccb074f4d3f450ae661634b7e55bd78e54b6714be3806856e5f9013bda0dfa756cab5136fe0afeecf013b94c0eb5b01f67b30066e31db8568f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
581e0cd4722a636c7535677c230cefb3

SHA1
1a7204fb04a39b3b267a31c6705c88cc08a732e1

SHA256
52cae4295a3d276f77f8a6a14d34c4f05495a7c8306ef5a53b0acdc243ef1423

SHA512
1e1ec5567718bd7b75dd9880db0d70afb2be3d2ca2a4120a88505c6e69b4234d5c36181c1f18e78e0459ca3464e3eac4e22ec7fb163ded54b912ed136f02534d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59913a.TMP

Filesize
1KB

MD5
a2a985ecdf67eb24bf4983cc33ae19af

SHA1
8310580bf104b86d6ec978068cda51dd93545d56

SHA256
711ac754f8a2abb1b1b42817bca3b6b0c66c06143a1645ea0bf3c3b93cacef5f

SHA512
a4c0828a9ab4d7c01d0cd0c565792f3c57b524e332daf8412ede3cc402e4171973e749db2638e134452a036af07dd60d600480426721ff90bdbdd9331c36ba50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cad0e9f4ce475fdd7e7fb73861bb54d9

SHA1
b251c496591bf11cda78fd7bbc23c1b3730eb5e0

SHA256
ced3f4e1342436d91279734b806eebccc936d1a0b20f67a4b290ae2dfe7deee3

SHA512
067153400f7827d50d521df1b54c0866e250e144df650c589eab743caec0f80d3382a92291052e4f72b9845e609c0df09031d91254151e5e7c698f50af3a6a8a

Download Submit