hxxps://www[.]research[.]net/r/Z6KRF9F

Analysis

max time kernel
90s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.research.net/r/Z6KRF9F

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
1344	msedge.exe
1344	msedge.exe
4496	identity_helper.exe
4496	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4452	1344	msedge.exe	15
PID 1344 wrote to memory of 4452	1344	msedge.exe	15
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 3656	1344	msedge.exe	28
PID 1344 wrote to memory of 4924	1344	msedge.exe	22
PID 1344 wrote to memory of 4924	1344	msedge.exe	22
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23
PID 1344 wrote to memory of 2992	1344	msedge.exe	23

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3c0046f8,0x7ffe3c004708,0x7ffe3c004718
1⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.research.net/r/Z6KRF9F
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6514212027594303051,16078561452394659334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
345f778978912e09c20ccc7b71e3508a

SHA1
8afe1dd3b6e20c62819c6fe81f8b2b02c554dcfa

SHA256
16afd81d0d216520c5c6245261bd89cfc43d994ca287026866ef172444e692f8

SHA512
a2a82bd269cdfc030449de4d47158c9c93312a1368189648b529bff869eb53a01acdf1438b46a3e667f2eaa0c34bc5c6f7e19a2c7979c8865b54f2a0b7f5edd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0a87261062a536c30d678c09e07a5f3d

SHA1
a8896778884c51478b87162ba920aeb2ed2ebbcd

SHA256
8cfd0eb406dc736ea5eabdff8ffd4dbf10214f9d92653da52ce91300bdc121cd

SHA512
f9665bfb0f2d05b7e9a2c46e433f8143085f40350a107b852f2a70542149d23ffd667cfaf7036495462396f69c3202b1530a44d4743878d1919735bd656842a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bdaad2e125080c8c55861dc7342a10c

SHA1
119a51bfc29780785025ae295ff17546bff37c54

SHA256
f4f796724150900f8bc37cb6a05bb104cfa7d109416d5074666c87c16e86eb10

SHA512
5e23ffe4df61dd4f873b1a3e61d0c133f6d42cdbbe46838c7c8a241b0501f7e6c78bd7825e9d527f9459027216413be1badf49e2b7fba5a6b11a9e56d75ee501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
827d29b9d1920bc308d41dada3e3be10

SHA1
43086f547217effe9380a2d1c07bba5df68e9fff

SHA256
a6263f5f0d8dad8866692da71cdc4cfde45a3c7869677803d105e962e1a9cb25

SHA512
c606522495d24cf93b7c3efe354169ed1a2ad43ee6fee8161881c711fb3ded8a34374e2f237f19a2a73c24a4d76d085112f98ab0853b70f232454913e3a61d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
87b090d7f86d1c3dfa8c6ffcbfee71fb

SHA1
ae978b90f5600c561bb4e8d64f43fdd725bc4095

SHA256
e19812406ebdbd346c6f1014063ba5795229df3d65ca123825afe7747982b4ad

SHA512
03d87849c1593148ceb92253123f342aec457511e76456f7c794781bfb9141167ba83f222a3fb53ad165b1fff504516cf1ab81ee5aaf180f54fa9cc19de9eb9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
e183ff1a48c4c1ab1839bdf37ca4897f

SHA1
c9882e44c837bc3ae09944c6907511a49d885a3f

SHA256
d53719a402a3eb1a442077d7e57cffd89d41ee1fe5fba9b07483ba84667905c8

SHA512
c137e2c01f50999697c8996ad8ee5462fc6037a56a749b5927b4c37088d2e4852e3638a49f88f76c397c0afc5a6a404e31d7259a9eb8124ee4dc34f1b49bbe5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c534.TMP

Filesize
537B

MD5
e65fab71cebf6a02a7f04b37c8726793

SHA1
c3e39aa8545043b1ae37b01c0d76d242d22df8f5

SHA256
f265b4e885c9ecbf9019626775e032222cf2a77f34d4f1b816f596b21680f083

SHA512
a0abe1efa9ff92dbb507a752888bc32240e2eb24526d9277fec0ac8cb63a042da5b3e0772cea80192454ae2a5c9889880e3bef61d117a1ec076b7e5db45cf08c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9b05d705c3b38909ac7bde16a529ef40

SHA1
401c8c95f5a184a717326a385cc50cf4a2c6d72c

SHA256
70bb1f71e0e5270b91dac219e5efe06f094b1737d1ced729e45b93399450ffa2

SHA512
931f6cad27133be8e687ea67800b7f48c6c8dfc1aea0b293521503a8950774db34ad62267cbaba6dd4eb1f6c1b5cb790e67a538f28176de918f0e148a174bfdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f5aa625bf43d7862d15da366a86b7ea9

SHA1
53619475a1388804013364f9567fc4a3aadd7d52

SHA256
b9b5c4b200c0a0c5ef12c70ef42a4dbf2313ffff5cc28392b7ff6d13a35a9fb5

SHA512
7b41aabf5b4bef18bcf8185195cf24118ca6e3eb090fcd60cfe49a11ae058d48362da32e774babf1a4d19834007e86961c4282ee18bb59c327f127e4fddb8f84

Download Submit