999d7d13b6534809dd286e29db87a29d6ab50d51ba8c19cbb123342a969fb028

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

864-97-0x00000000005D0000-0x0000000000600000-memory.exe
Size

192KB
MD5

cdc0f5864ae2f35d503dbfe26ca41979
SHA1

f4ef75488496dd247720ed79a6b6870eb298f9dc
SHA256

999d7d13b6534809dd286e29db87a29d6ab50d51ba8c19cbb123342a969fb028
SHA512

6b095a9a251a44a6bf2731b5f47cca73211087af2e3f2fe903c749cacfe574d93943868d4e2e868737151e517176d24e9ea40f27737a7104e8ff719cf4d79f46
SSDEEP

3072:247FCYO0NJQ5S0xNcIA7qVJeNG88e8hy:2vd0AEnCVJeNG8

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
4296	msedge.exe
4296	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4296	3936	864-97-0x00000000005D0000-0x0000000000600000-memory.exe	97
PID 3936 wrote to memory of 4296	3936	864-97-0x00000000005D0000-0x0000000000600000-memory.exe	97
PID 4296 wrote to memory of 1068	4296	msedge.exe	98
PID 4296 wrote to memory of 1068	4296	msedge.exe	98
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 2452	4296	msedge.exe	99
PID 4296 wrote to memory of 3708	4296	msedge.exe	100
PID 4296 wrote to memory of 3708	4296	msedge.exe	100
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101
PID 4296 wrote to memory of 4996	4296	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\864-97-0x00000000005D0000-0x0000000000600000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\864-97-0x00000000005D0000-0x0000000000600000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=864-97-0x00000000005D0000-0x0000000000600000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7fff429c46f8,0x7fff429c4708,0x7fff429c4718
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,253456752386210364,7194684084684223247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=864-97-0x00000000005D0000-0x0000000000600000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff429c46f8,0x7fff429c4708,0x7fff429c4718
    3⤵
    PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\133f0afc-4240-403f-805b-9e4a432afc6f.tmp

Filesize
6KB

MD5
8063372e57719ef8922452d380ac67f0

SHA1
c29625395ec19f9c3b741b2e89110514440894f0

SHA256
cb87558ab41d3999382365a1fe775239a345a7e4273f4184a01c39f2cbf49372

SHA512
f67d2e5264d272306f4a6047243f9c28fab69a2e30c0039911046cdaf8bd77d1c12f340455475268b759777f34c4d9e56ee70f9a020dc6ab79c5eb2a138ffd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
e0c557b5fb4b2cbd9a32b6b476fca7bc

SHA1
b2c56c01b940327734d1607535a63ba05a3744c0

SHA256
f33dcdc9f61fb37fd7b4eb071b3e58238f7ff5243040cad6c9e580a0cdebeee3

SHA512
8e3aaeb73fa5daea0b96948a05e5129ad3ac88cdda506521ca94998ce4f99c67e7ad6febace747724058e25c16397456e9a6f675560b733b22712dae68567948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef58c13571bc785e6ae0f1c5c09f23c0

SHA1
10cad5cabfc857b37c26f9d750c4a3ae046cf312

SHA256
f7a237ae3521fced394f9da8359770c47eaf10abd5e31c841ca199f8f70e0cba

SHA512
0b8640fc567997a08f347d8759ae2e14084442ac579e7a292faf31f5781c0a72e32f852d4c318eb311cb9480c0de7e3624f5210e21b6f0dbab2549757714d68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0065a11d94a7dae434ab6a706dcf0ab3

SHA1
528128facb0e0311f99972d5a335761c6f5f36ef

SHA256
6f20b3c3ededba3ac20281cbe4751968239f8057e94893852f7abfb1a94e8bf9

SHA512
c1ba9de90e30b24062d13ac1af5c1662465376eae8f9d07e5f660aebcc200cd186205a67234ee8ca238a2c4196ba25c5ab09696ab419e80361812ffec5241965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
6680f123956d7c4900e2182ddcda7e7b

SHA1
6e800259eab89d9a02390866f9b35515e035c1f1

SHA256
6bc57e9fe633651e59cd57b4cc8b1f4e234cde441d82e58d98f6b6628f13fdc7

SHA512
978104b72f8dcb54e0b5a34c2c5eabf82e8c07100c2cce28028740f98680fe4a9b99618b3f2b711da3a23b418c15bd94c6e3d6f64f27af08fb64461a60c61a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b41d.TMP

Filesize
371B

MD5
d44b94d52688564e1e5ed5dd9c8bd33e

SHA1
9a8e812cf11ac28c5f2e995289ce344e1d114242

SHA256
45f4f9aa8682f817a9ed9854d291e2cc7cc0c2e5c5bdc8768304b071d66f40e8

SHA512
034382504cf246b9eb46bc5a5078dd95ce5d4f4df70201143d9b91e3b8c5bf234b3a7e10d118bfd85f0361172ee66a4fcb1b5ca797446b7e1c763b0cea516da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16095a92d1bf34f25c8be456257f8ce8

SHA1
bb55561610b70ff4f90b7e522e0b29afd389c0c4

SHA256
eead22fccec78faa20749469f3a5045e70874dd2d3e67862a3156a0ff0b47555

SHA512
10e3977dc3c1967fea9890ed1958dfbf3b774ca141bce188921fa846070799e8f79f3f2ba3a69825b5465888f3533774de083c574f35a1c1411612ad3ca3b074

Download Submit