hxxps://www[.]google[.]at/url?sa==fXAyzqJOuo1MZpC667hPpjen8sVJqF&rct=A1YBWxr6hqcm6XItj8z0gdkwPQOOogfHXrUjmLCgPZVJTqTwAfaLrMr5sGSm0yLDz6&sa=t&url=amp/e3a[.]co[.]tz/authh/mvmth/i7ZUWjLObxX1KHpszpVJIBgVmW5czj5Cc8hHs/YXJAZXNhYi5jb20=

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.at/url?sa==fXAyzqJOuo1MZpC667hPpjen8sVJqF&rct=A1YBWxr6hqcm6XItj8z0gdkwPQOOogfHXrUjmLCgPZVJTqTwAfaLrMr5sGSm0yLDz6&sa=t&url=amp/e3a.co.tz/authh/mvmth/i7ZUWjLObxX1KHpszpVJIBgVmW5czj5Cc8hHs/YXJAZXNhYi5jb20=

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	api.ipify.org
47	api.ipify.org

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1208	msedge.exe
1208	msedge.exe
1100	identity_helper.exe
1100	identity_helper.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3816	1208	msedge.exe	83
PID 1208 wrote to memory of 3816	1208	msedge.exe	83
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 116	1208	msedge.exe	84
PID 1208 wrote to memory of 1496	1208	msedge.exe	85
PID 1208 wrote to memory of 1496	1208	msedge.exe	85
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86
PID 1208 wrote to memory of 4980	1208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.at/url?sa==fXAyzqJOuo1MZpC667hPpjen8sVJqF&rct=A1YBWxr6hqcm6XItj8z0gdkwPQOOogfHXrUjmLCgPZVJTqTwAfaLrMr5sGSm0yLDz6&sa=t&url=amp/e3a.co.tz/authh/mvmth/i7ZUWjLObxX1KHpszpVJIBgVmW5czj5Cc8hHs/YXJAZXNhYi5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb566e46f8,0x7ffb566e4708,0x7ffb566e4718
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,10552098570505535543,689370756767961729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
7ff4bee3c948e6078bb9d73bf56a4d3c

SHA1
9c89c4dfb2a727bec535daa3341b9c40fa8a4250

SHA256
9a7766e5bde7987f228a32b7d8e6ca8d5940cfd18c2caedd02e106b3533e3406

SHA512
4d97d6861716a9ec008b0229a2bfccffaba10ba365ef4b46b8111901bb12b7ff069986e711d3dac9fa630ab251867f0e0c94014e617355ec8ee1ba8c507ccb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6edbd2833ed555046c8bd5e16042f928

SHA1
5b6711784d32a17c804067e03e50e9f6697bafc0

SHA256
df95b91cc5379e668dded3e3d2d9e05228ab39c3c2aea0e337dadfa2c1546e80

SHA512
be8589a0f4516d8feb8223278fe957d6c11c73c6ef6d6925f730988c194a25947bc6619e16e6d73f0983be7a2cd3b0728fdfc38a3bca2220da191c21ce1703c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76778e5e46be42f88be525f032dc1a03

SHA1
3a43c259c15261c2b61dd07c5d15cba5e5db1187

SHA256
b5a854096920a8f0c45cf3020c77b32c9400331672ba0743f4179a29f99599eb

SHA512
e1da8ee8caa5e53796c84d2091c6285018bfc2865a8e5daf563074f869d9d54049b18b14e2c4a7bffd603d58d6bac5334b26ef1ef3453996fe7189777a7df14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce2873ab9e5ef75b63e2090225488533

SHA1
578b9cbdbecf80b6be83f2d0bc895b198431b95f

SHA256
cb0d19f808157c0b0e9f1538268cbbd52ed503ac7b3e7feb6b4815181f93befa

SHA512
47fa135c3f9ffe209bd2cd90cf655009b7d5e10137771b519c3b2740cfb32b6a3d79c8d29cb3aff70bcb0eb71a3a8444ea4468e813ea6123dc494918e3962a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
727edb7a7c4b28bd442ad155b68add06

SHA1
67f0e23e592cbd5d0a5577c368fec3ab7e7bf9cf

SHA256
cbfc826c4f1f2c638d89ba41f106c70e75d4b80fc2ef44e3969ba06ddce508ad

SHA512
9869e5e2b787b31df3d2d2f58618a9a828b3e986cd842431bcdb3472d3dd2fa0f526d534f731d2df5e7e8c60857900b478459b2c77a994c003f6f59fb3ab0bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
83bbace3fe22dafbb86f66d9f10a31a9

SHA1
74ee345eecf9c8028a67fe435f42f9673879b6a8

SHA256
dd8ff5a9c0e09d4b0170680de0a5651485d7c5abcf86bd8dd22b467e43ef7df2

SHA512
000bb58f28647e7f0a5de67133c21deaafab86604a3b9feb173b86be0c67a071847db50aa95903516ac3ebcb24506b873f03d6718326b870904f0b61d87b02a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c4f.TMP

Filesize
204B

MD5
66cef48c89628b228d8c3026facbbb77

SHA1
31839d2cd805fb0f82360edcf4ac608ec0163d37

SHA256
cf9f98b1935bae2ef86a17e9afb5ceff909d1cca34a5f339d82101aaa8cd4cc0

SHA512
2f339e1002225b7ccc324e8d1ee5d90a08822db0bf6e958df85b58eeb59384b226c526a680c002cfeea45536f7bb02a401e1c969584e5bd8f740831c868053b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3215cdc41c20887f2ed40f37d4b3e60

SHA1
e6cd72a3a01078eabde9996ec7fec79b8d6f12d6

SHA256
d5f5512e401772da68a1d2dd4bf8290809cc7bd6e621b1b0cb5bcb2852cb0b46

SHA512
77e64e03ea126842006f89c3db9f4171c4994ee3a798735189c5e7eb17090f6417d3edc383877a678544df3865bd07a83b5d73eebf237a3ff7735f3a3be9b323

Download Submit