hxxps://www[.]google[.]at/url?sa==qPF4CajfptzRAuYP7UlVCtqUujfRxd&rct=xwjpfeHeWdTpKa7CgdPrQDUfENb7DgpCczl76vjLEYAIygXJzBkH1ShcHXsdha2TA4&sa=t&url=amp/e3a[.]co[.]tz/authh/mvmth/0qtvXmrENFyQFFk2UUJb8yUxyJ6Ug1sCvua4v/YXJAZXNhYi5jb20=

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2025, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.at/url?sa==qPF4CajfptzRAuYP7UlVCtqUujfRxd&rct=xwjpfeHeWdTpKa7CgdPrQDUfENb7DgpCczl76vjLEYAIygXJzBkH1ShcHXsdha2TA4&sa=t&url=amp/e3a.co.tz/authh/mvmth/0qtvXmrENFyQFFk2UUJb8yUxyJ6Ug1sCvua4v/YXJAZXNhYi5jb20=

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
58	api.ipify.org
59	api.ipify.org

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
5008	msedge.exe
5008	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 3364	5008	msedge.exe	82
PID 5008 wrote to memory of 3364	5008	msedge.exe	82
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 440	5008	msedge.exe	83
PID 5008 wrote to memory of 4376	5008	msedge.exe	84
PID 5008 wrote to memory of 4376	5008	msedge.exe	84
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85
PID 5008 wrote to memory of 3164	5008	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.at/url?sa==qPF4CajfptzRAuYP7UlVCtqUujfRxd&rct=xwjpfeHeWdTpKa7CgdPrQDUfENb7DgpCczl76vjLEYAIygXJzBkH1ShcHXsdha2TA4&sa=t&url=amp/e3a.co.tz/authh/mvmth/0qtvXmrENFyQFFk2UUJb8yUxyJ6Ug1sCvua4v/YXJAZXNhYi5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9eb5a46f8,0x7ff9eb5a4708,0x7ff9eb5a4718
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11935283732812537048,16089343226839985697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
5baab296e85cbdf3144649853c615976

SHA1
182f36e49b4dec38eab6f5ad45e61344cb47caa3

SHA256
64a8ceba3b4c50cf3723b05b0ccaf9a85ac49e936d773f9171cb9ed1b85e3a46

SHA512
8b0ea2a44c4f4d7530fa0235917307fe60d4ebc3191c41b97818ecc4e03f82b2cc2b83dc618670322dbf820c1e5a94e7edcaca17f14a865545d8b9ccebb3ee7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e1affeafe990fb0ba23aa4f7a08b161e

SHA1
a1fb55ec3408f17588b099ca88158e2131ce6d25

SHA256
8fc099170ea281fd0a89b4cb5a5b727be848eaa5c66d266f42f8ba5c905da1bc

SHA512
c9f26c90495cefbbe6652902b8ece293fa979b8c1536028cd2b025899242d244fd1ffbcc63b3f356e3dfd152747a1e2bd50e58e04eb3847d14b7d534a5dd593a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32ac10713e8b42ce7cce72869a6bf9b4

SHA1
69f6a25d4d6cfadd64ef7c80d49b6e916ccf9e00

SHA256
0f3f7025d60e1a7622778c70c8597cb8ec4c6d12e5c1fc128d550eaac3ded53c

SHA512
c8b0e556b90789408cdf55c210562c11f8e932eab8c4b80ed9500e3323f5a13ff437a28a5922d01a4b03ab91c52fe1ed36b2802d3e1bb618ef66036ef9fdd0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cf443e5e2195fbae4631b903f7bec14

SHA1
be30da99bd493ae09b67236601a33fda495fe31b

SHA256
66a06032f8cad4811449be085e2f3bbb16cd0b038f558545c797c96cc95713a3

SHA512
26a4404c6bc761fb2c95041262b0e1d5e6451fc651318f68f1ffc2424f0c50ab1e565fe8bd36efe470d0c869e2ad04a04c9bbd099ff4930d0cf881af87ebc18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6438c5ca48c2ac0cb6691a861032293a

SHA1
4211650c223e7c98feca659dad41448187eee4d2

SHA256
0c796b362a735430488b61e7a88cc76d5e1e531589a14f7f10588d0f20d38c72

SHA512
9f975c502d8ec96a1dc50d3689782f757f49ce84503f452a80a3231914732f9df854033bf29e014a2447612892258094c300408b1cc1d693ce92f7e323022a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
edf307903aee208cc1a9ac2194ccc923

SHA1
8455c38d007732fda6daa5e732cbd97db6943176

SHA256
5fb4034fb4ce03905a0752744c215063db3dcecca9658023389a43acdad36826

SHA512
a3c98c96d0e2a5a4df4ac2b3d2c8d9cd3a1ec7fa0e7aa780f578dfc45d60b9a855d5b884cc4ceef3fecc16091ad6c47e8215f51cd1414329e44b3fc1a25a1d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fe36.TMP

Filesize
204B

MD5
f3aa60554e046233b6b33ad2edaed299

SHA1
49d91b068fc88ea9873bb591cf35f401b480c98b

SHA256
a0cd68ca42d097cae2daadf88998b2eca15978536b375df29fbc6367bdeb9539

SHA512
535e6bcd4e752072409ac799a7697b7416bc66755b4a9684761a668f529f308c34e5498b4f99d6d804d17ebaefd3324179c891567a22c28bfcb53f43f01bb13a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3ab2698cd934eff5b05ad84fb6e87693

SHA1
ad91f348226714c2a931220b0b52bf484e90f4ad

SHA256
24a28886e44d3b38e94d02f73e4a34c43e06285fc4cd952b41ef1baef61de7a6

SHA512
4cce582cab57dc3c16692f542cd73845a23e62dfc495e4b945b30237533a125d147fc04a72f6887daca651dea076f1c3490064d7c21a73be7b016fda942b59e4

Download Submit