hxxps://google[.]dz/url?q=tjiypJLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2fhandlingservice[.]com[.]br%2fyoya/mjhb/a2FqYS50ZXJsaWthckBkb21vLm9yZw==%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A

Analysis

max time kernel
157s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.dz/url?q=tjiypJLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2fhandlingservice.com.br%2fyoya/mjhb/a2FqYS50ZXJsaWthckBkb21vLm9yZw==%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
4800	msedge.exe
4800	msedge.exe
4556	identity_helper.exe
4556	identity_helper.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2832	4800	msedge.exe	83
PID 4800 wrote to memory of 2832	4800	msedge.exe	83
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 1452	4800	msedge.exe	84
PID 4800 wrote to memory of 3440	4800	msedge.exe	85
PID 4800 wrote to memory of 3440	4800	msedge.exe	85
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86
PID 4800 wrote to memory of 4520	4800	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://google.dz/url?q=tjiypJLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2fhandlingservice.com.br%2fyoya/mjhb/a2FqYS50ZXJsaWthckBkb21vLm9yZw==%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff963ee46f8,0x7ff963ee4708,0x7ff963ee4718
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,655968367982479810,14397449431930919482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
51f04e513e0b0cfd2c22b7bafe30b83b

SHA1
0e8bcb5cd874a556ff8445ec7933aecad83c6ee2

SHA256
0e8b33e8e7a494d6a33d54db0dcde8c189e6f30674ccc4818eed17305de11928

SHA512
3ffe5038a7980d2ec2365846d4e26bf5755a8158a076db8812eb852998291ac06690193bc96eb61a6e35639ef9edc3daf45642d431e2e4378c9a300f8dd0c530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
81cef57b16d4d615cae0aa689087ade2

SHA1
7321ef801b9b2e7d619946dffd399113828ff555

SHA256
890ecc6f3fec4a2fd472082a2e13dcd2a5bbd40906f9046c04a6d9e340d7bacf

SHA512
7acbfb67b40489e1ca9bb503dbad8a7cca6bf6090460a216e4439aaa5cc9198ba843a19a62e421431b4795586eeb2d9c472ce908ea0d4bb0c0f4ef9f76271e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
c78f493f03b7b67ca317e2691d7bba0e

SHA1
3076d7351d63036db89901fe2c7c0ea8e2fb0e04

SHA256
c27c15d511903990db95a862ea3058b36e43fac45f1fc21bb8b63a57692e5a98

SHA512
3f152cbb1d36a063e29341653bdffac7557b0f2c5858dd4caef8ace78307fda037d398aa2887541fd49fc64bcf866d1c66d3fac662b36619f9ac64806cb4030a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
7f43ca0a63aaf6498f0dac22d118b9ca

SHA1
4137075f8e17fe7349eb09d48344228f36274a2c

SHA256
ba5c9ce95a8476105eb71a264c6a1f12e6bc29b4822cd2a097da2ea8e8e5128d

SHA512
49913a70b0eaca6f1ac7f384479b5c9747ed06f9cb90650e0a858c165ae86af6c12093d3a44908aa5c4d9a48ecc4fffcd38e54142e08ac7e09fd1c3b629b9161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b9e9ca48f4cc63c6e4a5ee14691dcd21

SHA1
bfe75b010010e285951769b08a83b83c0f198f0b

SHA256
24d9263b24e5cc9a5c7bb47acff1fc06cd4778b9b081dab87a97664c7cbef720

SHA512
d8f240e0e695c86b2a77d683e533f70e80edfec8e7e9dc7496b0dc54c499393c7d9fc372da6f66cffbd3002c25a60e17354c6125d60755dd1cda7643b7be2435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7b247855cdf8fec2f443b4dffd789aad

SHA1
7174293cdffbce1feb5d45ba58ba68666af1a87b

SHA256
848f45d9878c0e3dc20ed67ec5c176e9a6328be70b2f96cbd2cc1c6ab4da297a

SHA512
844c9cfc799bb0a9f86fede4caaceefee9aac4aa5ccbcd88e37fb87c0085d037cae142355b52da55dcedbd8983d6bc9da6e903a7ee33868204e2ff95eb2a5dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c37d9cd70316e4ddb4781aa126f97bb8

SHA1
3be01e1742468f16f64436a7fe6fb093893639fb

SHA256
c3ff915e8cef7a823ce81d395e244ddd1034ece4a9aaaff67994ea48d35c62a0

SHA512
095bacb5ec7568e58f93503ccc1f3b03719131a06c09f73b997f680e40e7fcb6121a3e22741ed90d46fddce23ff03c3b2831cecf6e02c3473ff30b11a35c1a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf7a43b481af12f7d55fa5b9419242f2

SHA1
375b05581caeabc19f5e51142569ae5fb74f679d

SHA256
6e2eb888eaf087035eb8d882da25e87a28cb478ff8e23ca77af160ef652ff1ca

SHA512
d310532416fb9a6809bf638c874c0f0c68aa0293d74111497de091efea5a983ae2fa1a2b6c0c954cd2919b5e04035b18a1d9da5fd79ee9c5e7eb08ad2bc03511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
a6640882319ed463c310117bc6afa9ab

SHA1
4ee6f6cc45f357fce8dc47d8e243a0cd22780413

SHA256
70ba37cf85eb3a4ff80be3d28ef4079610b5854c88ceec135c41b0742d277b08

SHA512
29e72c0dd36b12a8f642f3b7bb5af32b8c3d2528fe9476c016a54a834045df49b7ff1c8a8a573fb1b4fc3336896c251fc384071ad12d4a40a25cbadd2c57bf7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59ad0f.TMP

Filesize
204B

MD5
7b506cabea639db935390c34c732a5c4

SHA1
59dc2a40aabfddd310b4f7ec96da313e36c1906c

SHA256
befab276f6b6bf1e098048e7f095b5c5427ec2fa16ae50164ef8e398ffacca67

SHA512
6a37b5b6926ee10c9dcb142647bb2ba3f78ceeaa5edc7b4f0f67468500345d6e9e5e5fa59eb53e1e0d2455888b1bedba6aa9541fe3f8b4ebf13e1ea98b6f9214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0ffdddd68788206a053fd6f89334f33

SHA1
fb1e569890d1cc46b1c520a4081decb1b924567c

SHA256
d8c28a58f75176a7802077353dba7f6a64d7e50b7e1a5c8d4f0bce98e41814b9

SHA512
ae2413795683646c1a614d591dc0d7c7dce0a009f16ac416e5c6dcd653c10c103afdba3d81b69dfeb8a632a80ffb0713fa79f7acd958a7d9193da48ab3e8dfd4

Download Submit