e600f0018f81a62de28ca35b58d09fe5f09a5d26fdb5c5ccae9ebc40454d27aa

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4476-25-0x0000000000440000-0x0000000000470000-memory.exe
Size

192KB
MD5

ce628db5981db892af1019ed8d7c95b2
SHA1

9c794fb4e7fd32c329c02064e0cd0119509ca4de
SHA256

e600f0018f81a62de28ca35b58d09fe5f09a5d26fdb5c5ccae9ebc40454d27aa
SHA512

a1460185c1d077fd89b4673b03b81ecf7f433be1d94d7eaff5d172324825b922a725e19a57564a352c0b59899533cac6b864c50f869df62c25cbe8882849c895
SSDEEP

3072:8w8wJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1JY8e8h3:8hzAmmI0k7vVe0E0YIM12

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
3144	msedge.exe
3144	msedge.exe
3884	identity_helper.exe
3884	identity_helper.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3144	4308	4476-25-0x0000000000440000-0x0000000000470000-memory.exe	83
PID 4308 wrote to memory of 3144	4308	4476-25-0x0000000000440000-0x0000000000470000-memory.exe	83
PID 3144 wrote to memory of 3716	3144	msedge.exe	84
PID 3144 wrote to memory of 3716	3144	msedge.exe	84
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 5060	3144	msedge.exe	87
PID 3144 wrote to memory of 2660	3144	msedge.exe	85
PID 3144 wrote to memory of 2660	3144	msedge.exe	85
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86
PID 3144 wrote to memory of 4816	3144	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\4476-25-0x0000000000440000-0x0000000000470000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4476-25-0x0000000000440000-0x0000000000470000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4476-25-0x0000000000440000-0x0000000000470000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe0,0x118,0x7fff652046f8,0x7fff65204708,0x7fff65204718
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3871011870808089228,12429287554309775058,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4476-25-0x0000000000440000-0x0000000000470000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff652046f8,0x7fff65204708,0x7fff65204718
    3⤵
    PID:1900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
6c304cf49b6668daa9331c2546227169

SHA1
651623efc4f2c9589268bfe45d0637b660b4b63b

SHA256
553557718b51e1b35fcfe745a1ea14abca7eb41ab980d422d3815f10df64a0b8

SHA512
47ded58c9bfd4b01bd97684dd3a1ff48cec6538bbab5c9c8118666017669ccc178ede8ef6ca74b0e32dbe89cd35e25a98f4c3dd770a002594862e8f0125b2fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be52e2bbe05d4d78fed840159b9b7a12

SHA1
25079650305ec6f5a92e305975a691ea0eaee602

SHA256
09368cfa9c4619261a1a465ae4d48be94137939f7d4fcb3718bdf7585f8186cf

SHA512
864b1d0621e8afb02347ef1bee3c2b6b395aa95d58ee193dc590762ec1e03c2ad2480a1f3eb9bbd60cda15ff0ea64d16f1c4d325babc1f78ad788c9cbbaf5afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93355bff94803fc8871e7db7b7e7698e

SHA1
4a0ce958949b8d2a1aa3a0abb6c9d8c71fe5961d

SHA256
5a683a08b6ec78e400a2a093090f4d3dd45ba09e99b3a3d981828928399bf43b

SHA512
c6aa163d16546180e098ab94ff24ceed7c03bb99ab91705df8f679168673ed3642427f4c0ca095bc6f063c5d5856a20c98016bd43aa0e39fe09320fd722724ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bcd0ce337db09a9d31a6330ba595e749

SHA1
8ea7814a5413a24e8819a5b5b4d6a03ebc1f05bf

SHA256
6491ae72c909ce98f1b543ac4da291fdac122d4ba4e284a12b2e617884f92721

SHA512
88a577df77b5e6110a8f8c60761acadcbdec2317a4fce1aa6e57bc49f2450aba4499c03f00c3f24c993807d5ca4934e45bfd8a5b119408f0af57a95c42599e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
615879f975e9976efd106d66763ac192

SHA1
28d883f7aafd3516f245cae8369953dbdbd97b64

SHA256
2e2f6d6481da71e667162fe4259a8030c1737a450b1fed38914bc5b5dd3476cc

SHA512
e58f371f9c1efa19ebe86ea84eeea8846f0bcf0af5313d70b3bcee8ee4812a1d7df83c04eea1852c3405a1e131e8ec1f8dda3e1f4c963151b8d16f748b29a7c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d513.TMP

Filesize
371B

MD5
902b178decd0b3f3392370e53d180680

SHA1
03c84b39987c883763ddc55cf8014dcb2f669d88

SHA256
6924fcc34d089f34a96e5389722dd5af8f77eadab66859cc867397cfa7341cf3

SHA512
26f37b8baf55428098c123bebb0acf906a1b956d034497f9e6aa13a5caa96a1f120bbd607402069d8ca4461a87e915d41e520849d4161e2a964cf4362ec5c0b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c608a0d8db1fde859bd439e5277c23c0

SHA1
8f1a3cf03aaad45e177b1c4e799521e6450aa025

SHA256
690b79803604ad9d90e4673fee663a1a48eeffd1922ce858f7fde6ce4bc9b07f

SHA512
1ef03fb52a786a290cc4c2560f0cbb5141d062a45c578655326ec7be53a4ce2cb14e9606661ea27463d4b7a900901443213b9fad056e6fc8c02464e9cc17bde1

Download Submit