34b4452fa135e9631321f82c98cb294bc64554daff70498f810bb3ad0a853a4e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2148-113-0x0000000000250000-0x0000000000280000-memory.exe
Size

192KB
MD5

7a0f7e997ad22bfedb1454686ce7ae5e
SHA1

3a0992dc7807bf0c11870ba3baa05b500ff96977
SHA256

34b4452fa135e9631321f82c98cb294bc64554daff70498f810bb3ad0a853a4e
SHA512

f45f5ae635ae970082727c751cd0c89eaa9f7477de90ddfdf20591691dee3588ca6cfb8e436636eea02f56b025aaf7e86cdbf3dfb15b741c3b047f58b9bc547f
SSDEEP

3072:5UUEa9Te3JQBf8td3/oxN1ULH0tys8e8h4:a7QRyi1tys

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
3308	msedge.exe
3308	msedge.exe
3908	identity_helper.exe
3908	identity_helper.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3308	2684	2148-113-0x0000000000250000-0x0000000000280000-memory.exe	95
PID 2684 wrote to memory of 3308	2684	2148-113-0x0000000000250000-0x0000000000280000-memory.exe	95
PID 3308 wrote to memory of 4172	3308	msedge.exe	96
PID 3308 wrote to memory of 4172	3308	msedge.exe	96
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2648	3308	msedge.exe	97
PID 3308 wrote to memory of 2192	3308	msedge.exe	98
PID 3308 wrote to memory of 2192	3308	msedge.exe	98
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99
PID 3308 wrote to memory of 1672	3308	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\2148-113-0x0000000000250000-0x0000000000280000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2148-113-0x0000000000250000-0x0000000000280000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2148-113-0x0000000000250000-0x0000000000280000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff8117a46f8,0x7ff8117a4708,0x7ff8117a4718
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10689123737431033879,6361745203988384574,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3124 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2148-113-0x0000000000250000-0x0000000000280000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8117a46f8,0x7ff8117a4708,0x7ff8117a4718
    3⤵
    PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
aec61b150ab21dc972f2f48a9aa461fc

SHA1
f0868b9a49775d510c8703de9abd1b5fe6af257b

SHA256
5880a9871a0e55a2dcb31aa07707dde58d94560c3313e736aab91bb84aeb09c4

SHA512
0f2d0ab9f1fba669fe2e92eead3c9d5cf9941600b6a4a9690ecee1abbbc894ce76d869cf2916cdc144b74a4858ae66dcd8c89f649fbffafa72766fef1ca1c648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f36d69e5fcd8898b36c19f4f189eddbe

SHA1
40ded7265974d787ad31939134eaa10c0ca8c306

SHA256
b24fe62bcd2ab9c62c872366630e9ff151545018f2889fb708e51a4957f75db0

SHA512
792477f37d63d26250a823c7e1c267653c8e4c1bffbbfd107afa3dc335cf5e1dd7fc8b06ba0fc3a107a71b63094180e47918b4aaf557245ff4c8259e84487a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bff4554f34810611d6304cf7998bb495

SHA1
ba70893f6aca4bc3ccc628bee4e59aaeecb8b4e6

SHA256
5172e50dc2db91efde1a9f6662b67ac7df529073f2b7c2543f9f9e02833efd85

SHA512
a5705393468f0f3317cf1005c43922df5190592e05ce8bcc2389b58245a4cf49286d1cfef0a112f902936e95f07911cb6d587a2b90c4101b7c5e0af818f5a7d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9ec65dd5784f52c2da00f22542adb20

SHA1
3b0bf652eefc2773f6bf910f3028bf095c71ce16

SHA256
07c77479c77685ef8f2bcea2f21f99e04c1bd20e65ff9666f679c778866d2c7e

SHA512
b573dd22d2fc6f8ce4dcfb91b97bec4c2ad6f90ad418b142ff1490b82a51b1a498333224ab0806199f06d47fcac45d15aa27e02bbf71a2e9375e55ed22f70a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
c14601f260277c3f2a554d01fddd5a2c

SHA1
2059b267b7ee152ca379d421ec896a12f974ba7d

SHA256
2bc0084bf63f93447069702b1437b2c45e47f2ab3b7cd0a02ed1eb939449def7

SHA512
a151ccf75ec8f6ef9cc88cbfda6d643f2010132f6b8db2be19b61c1db7985ffa9bf3b5e193ff0265fd0e35a2ec8765f8be490296fd20b7e54adf958cba9570fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a97e.TMP

Filesize
203B

MD5
34a2baf24eae2d66bdf5c3fa15ef587c

SHA1
480ef59d21840a14ac529cdd712a25b6d0b3ae4b

SHA256
ab9ceff76c191e09de553d3370c913ba1f6a6d85e4a9904cde74e285f9a349c2

SHA512
9b3b8ee1e5e7e20c0aa3fa20964dec09cf14ce4b1ac773bb284b7a1b203106beefe0ab106d1b175dbff1a842c01acc9b93cfe23c9dc1d17dbe4451c2ac7e6b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0407a1f61b26a357d52c31746ab12f69

SHA1
006a826f2e83e7a1ac13b9083f7254848ff0040c

SHA256
b61dcd822b294e475adf78b3e51900a8724436f495977e55bce372dde3ced693

SHA512
d6ceb5b54302edafdde76e1bae45c88f1cc7a063a29f899c3daf173c5919d5ff9586d7dc26521dfbe5492590affc83e85d5eea27fd0f1f2ebce7c39828a1ceb4

Download Submit