3b4bcc9ca39c7c62b29cb4a6f3426854abdc1f1b5ad151c117a219c10e6560a8

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1092-113-0x0000000000270000-0x00000000002A0000-memory.exe
Size

192KB
MD5

03b0ef0cf2b740babbc8f2a065ab7dd6
SHA1

56798172205239a890ec77318edd5eea52100f84
SHA256

3b4bcc9ca39c7c62b29cb4a6f3426854abdc1f1b5ad151c117a219c10e6560a8
SHA512

cd1ee7357b4b374750157b62aa94e2c44a4ee39a0bc0a2b66d390b0182e1c99b68faaa291086a899be91f3a4f0db6168993e97d5d4bec84a0ef99826b5256ead
SSDEEP

3072:oUUEa9Te3JQBf8td3/oxN1ULH0tyq8e8h4:r7QRyi1tyq

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
2620	msedge.exe
2620	msedge.exe
908	identity_helper.exe
908	identity_helper.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 2620	444	1092-113-0x0000000000270000-0x00000000002A0000-memory.exe	92
PID 444 wrote to memory of 2620	444	1092-113-0x0000000000270000-0x00000000002A0000-memory.exe	92
PID 2620 wrote to memory of 3468	2620	msedge.exe	93
PID 2620 wrote to memory of 3468	2620	msedge.exe	93
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 3824	2620	msedge.exe	94
PID 2620 wrote to memory of 5084	2620	msedge.exe	95
PID 2620 wrote to memory of 5084	2620	msedge.exe	95
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96
PID 2620 wrote to memory of 404	2620	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\1092-113-0x0000000000270000-0x00000000002A0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1092-113-0x0000000000270000-0x00000000002A0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1092-113-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa6e946f8,0x7ffaa6e94708,0x7ffaa6e94718
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,1303067863382732011,546739822214731633,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4000 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1092-113-0x0000000000270000-0x00000000002A0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa6e946f8,0x7ffaa6e94708,0x7ffaa6e94718
    3⤵
    PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
5631e348c3e84853ba8cd3bd65077e31

SHA1
64d2ac33668f679c8790b9820b17107c6ba93bfb

SHA256
9793bcb4a48b4fd9fd9b9c63c21879e821fc1a4e4d0b170eee60cbe6a4bb6b5d

SHA512
903b6c655d3f614ae3638c082c11a0868fcb6a3b49c0a3176daf1cd69ddd5c80e7c29a13e83ec7c9d6f8063069197dcc4746e136aa3575f874c84d05aefbb558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41fadbce2a175f1e8b7bc416b2873e01

SHA1
e9dd10a671ae2c7623bdbce6ad41b67fe018e2f1

SHA256
be42229aec18b6606d01ddf9c4ef6ea718a6c172315521792fe78e2103cc15f1

SHA512
1479dbe98c2399996e5f152e2be538aeaf507d9b7791cc5af4cf7b7d16ccd84eb2db61ccb71be079fa6c308e9afb7fc469900afaaaf9e1e72988d4a9822748e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b595b978f2dc0cea1f890f8b2833bdd

SHA1
577050ecfff4943d80a6c7aa3346e071bfb1b736

SHA256
437e3202271733628c2ca79fa79fdc8560dce0eb69be2addbff8764406b02e87

SHA512
e997ce69a97a2c3ec5fe1e3d77d92c0f7ea088a0d7792c0e7d629afd0cebdd67daa6b8b6d8256920f01ba7a86a16581d20a98cce2b0ff85c1b952e9fead6666c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
960b532a77646eb323c48544a1086e1c

SHA1
53376099ba75d219b75f15147905cb3edd637674

SHA256
93362d4ffd8bcf01f01b4ce7955f57bbf4a497e1e554a38c45cd8e746740ed9b

SHA512
e0f745d9f127217e0d5a50221194b26f1130bfd097a0b0ee05073bf533f77125bc894cf5c5ee472b65b34fb7678dd0ca46b218279d83b0aacee905604091762b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d2340183f2db6f75886e9039e21c5be2

SHA1
fdb193fe4babc7af2e7746e9eb1a623e7999a347

SHA256
aae5ab8ceff7e03a1e9f462123abd2455f1b57ced5476ec1156aad173c8564dc

SHA512
9600ce5472c0bc454126c055692591e22d2ceeffc06c75b8fe50163ff1217969379e0286b61c34b32116263105ddab21fc66eb0d9cc5a9352212e2c4d518b56b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a2c8.TMP

Filesize
371B

MD5
9f4caa09e3ba254685289de49cf51567

SHA1
1cdef7e58af2c7d2774bcb0f79f9130344552ccf

SHA256
6ab45cc379964080e56e110d09a4e6c0dd2037e3c61f9a0c22cd9d62b47431d7

SHA512
45c8c4a25c0f9ac3db414b0d1b03836d85b110776ca7e80cb0988f788d7088127db315287ee8c3bb3b4fc5c50f2784e0d58ab2bdff3263d3a1d57ebb79e3e6d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
27a73958c6c1ee167adcd8d1384a5e49

SHA1
294c2fef5d3e4fb875ff6c0359e02e174cf3419c

SHA256
301268feb778940f888fe7dbb8cad343b98a51053e3c840d83215d202b1852ef

SHA512
0522d7d0a8b179a47482c98f7ce660a55f66cdbf83020e8d390870ab6fe9cfdde0652b27a26838a7f4c43be431634c0d80f60f6e494c3c5985fbfc0ba88b5ea2

Download Submit