hxxp://supplytic[.]ca/chuu/wpia/posha/sf_rand_string_mixed(24)/aeberhard@matrix-solutions[.]com

Analysis

max time kernel
900s
max time network
863s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://supplytic.ca/chuu/wpia/posha/sf_rand_string_mixed(24)/[email protected]

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
4260	msedge.exe
4260	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 2760	4260	msedge.exe	82
PID 4260 wrote to memory of 2760	4260	msedge.exe	82
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 2300	4260	msedge.exe	83
PID 4260 wrote to memory of 1436	4260	msedge.exe	84
PID 4260 wrote to memory of 1436	4260	msedge.exe	84
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85
PID 4260 wrote to memory of 900	4260	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://supplytic.ca/chuu/wpia/posha/sf_rand_string_mixed(24)/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc13cc46f8,0x7ffc13cc4708,0x7ffc13cc4718
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3505396776913755191,1816219089392856260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
696B

MD5
e37999a9e29bdb2144e7242df3e9162f

SHA1
0ea25cef76a349d8dae03ce5d8a033afa04368c0

SHA256
1dbcc1c1d5143afe35eabb993520251735bdbe925ce5627a646c42167689f109

SHA512
a7181a2df0616680bfa9a4bc96c6af187715a62e09dbfaffa92128a50c71c55d786fcd572122ae41106ee20a2f3ba1e5dd4ac6a19f8fbf35a2b497e39508e66d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
26d31628a439cddb3e0beef27eacc3ba

SHA1
6d8500ccce66da9c34517cd4edc50228e99457cb

SHA256
88aa9b3b333d6c5bff384905084af3fc934ed7149deba5f11de6882cfab49a72

SHA512
1a6360f6b81a69076468b6074da11cca31696c9eb903e24dcb3a1c6d5572ab4a4417baf58f3135ba2dc8cb4999032926e2e2913b76f6893413c5759f5fd02524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a976decbb4dfd890ce5cd638397b868b

SHA1
971658eb062c47102f59f4626ae05604da012f4f

SHA256
4706dc614f1cac96f53eb3a5bac968cbddfe367bc614b66d79e76a9c42af7c62

SHA512
46c95fa14b8a80a9ede40000cfc4e8b2666cc159c1bf9b732b14abb372fb0ddaf164ef5d339f879cedf91e26ee5a60aa6a89c921513f64fb93a1fd1335e24917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28e7136b8f7f0a4e1bc8a3e1540b3172

SHA1
b470ec280fcb7aba3e9cabd5f9b4e8cb6291fc78

SHA256
84c6a71e437ec4949c375176364072d12e667277d35c42c5e1bc45df2d2be881

SHA512
6f9b3e3047d270698530b0cfc64266bbcb4dc4ae5b6c8f2a72016c6ce9bc77df7f3f8b8fd89cb21eff700dc732fe0dc40dc65d158faacc9d236a051e5e784fa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
927a963fbc559c416ad148cdd3776529

SHA1
812a35337d0cd86c5f8c7fa84356fc54d1030290

SHA256
98c7ec669a131f5097e591a2d7bf3a66169b22e54e0acd1547f3bdf1b616fbea

SHA512
290b606c394fea8630ec90979e3843f5cae87db6f03bb6eddb778fe5146b52e906696d228fe2d7f58eadaa94b98db816ff0468027b2bcf03f2a2bd1aeba8820d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3af957da86021d1876bf58779a0a68ad

SHA1
0c4a13f86f1b9d8ec9c137d8d6d1088588ef16b1

SHA256
9566a73df7b4ecb8365d1403730b4d00593ad018f0f8c74b6f99ed314413b754

SHA512
9557955048e3dfb58873b6d8fae800bce5f3a0698502ad1748d7a55537f074f42911c6e3fa563cbbf2c2408252f27fde3bb207dde5405c89be9d0b7dc03f812e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817b9.TMP

Filesize
1KB

MD5
f16dbb67a125b007f042a7ef2cf49cf0

SHA1
e016ce435ebf09b398d411bb17ef5f11ebefa528

SHA256
144f8be8d5c86a05fd588eb705512ec2fad660671abb42438fa3607e4e17adc1

SHA512
062259a80c9b9463ab4db11ffe90c2fe4cd7dca6c37e7a2949653e940a8240492ac5aeb98ab53299268eca662330666fa19942e3fc0903952e90500edcf1921a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98a608aeb1a938ab7b82ade2ac2148b8

SHA1
06e6137cf5c4b54188909206d845d5bc948ec14a

SHA256
51cbc0c149888c75c54098971cf26207ee968d4703e5501d4805f1fee0e02cd0

SHA512
bf2120c2273b3b9250986405e63748066f9bb8bcc01c824a31a56a2e204bcb5631458725eb805348b7927edee69de5fbfc111dddd1b035bc368cb50c37549be9

Download Submit