18f7892360466122c471f0f76036fa7e7c48a26cee6ab0599cb4fce45c79bed4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

836-97-0x0000000000250000-0x0000000000280000-memory.exe
Size

192KB
MD5

e9ffa1936c2fe8c6e208428bd7b6cd4d
SHA1

eb2cb28bf75a398bcf46d249e3e42e12d995cad6
SHA256

18f7892360466122c471f0f76036fa7e7c48a26cee6ab0599cb4fce45c79bed4
SHA512

33fde09468c7d395febec6a210e1a7b7449176fed058dd00e5e632f9e4c3d7a8ba0534e871194d65bed41433ad2ec2e9cd73f88da0d14ba2c10461844bb3b2f1
SSDEEP

3072:x47FCYO0NJQ5S0xNcIA7qVJeNGU8e8hy:xvd0AEnCVJeNGU

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
5436	identity_helper.exe
5436	identity_helper.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1424	3696	836-97-0x0000000000250000-0x0000000000280000-memory.exe	96
PID 3696 wrote to memory of 1424	3696	836-97-0x0000000000250000-0x0000000000280000-memory.exe	96
PID 1424 wrote to memory of 2976	1424	msedge.exe	97
PID 1424 wrote to memory of 2976	1424	msedge.exe	97
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 2920	1424	msedge.exe	98
PID 1424 wrote to memory of 1212	1424	msedge.exe	99
PID 1424 wrote to memory of 1212	1424	msedge.exe	99
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100
PID 1424 wrote to memory of 3688	1424	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\836-97-0x0000000000250000-0x0000000000280000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\836-97-0x0000000000250000-0x0000000000280000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=836-97-0x0000000000250000-0x0000000000280000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb9c446f8,0x7ffeb9c44708,0x7ffeb9c44718
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8089505597461026975,14827372868979669285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1324 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=836-97-0x0000000000250000-0x0000000000280000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb9c446f8,0x7ffeb9c44708,0x7ffeb9c44718
    3⤵
    PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
f1acf91c5b7e288a122a1efbebdb8cb0

SHA1
536e5b9cda29cbd5fcf3fe3d7efaec5195b10450

SHA256
80b04a4356c24433721774780c7b6f1517ad12f5e5aff18cb25faebf1f139223

SHA512
fdb318342d30dc1fb957c3345760f6121e8f8049893d4cefb045c3a7da5ea96869758776a7ff7abe15e96e061f209b772ef3ad15bddeff62c7337093e110520b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1937ed11fd6acdc081f301be132c014

SHA1
c38606f17898f48ce02d034a5f275dee7555ff57

SHA256
77c3264abc8101c785b6439188582e93e1eeb99a79218fb623d432b019e58209

SHA512
f1fcee03e199c7b5521548164be6fd7ec5e1773ae6e7d42cfec97b212a4c13034bf1b27cf6c5cb520beb67b1c311083fccebb18745183dd24895fafbda3a7982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12ccded4e5626c858a493f7093ae3493

SHA1
82fb3d7df0873a64496b9d9e7e7c1d6024e14525

SHA256
f4fbc110214543af539491afb3e4f16ff4587295ade177c0dd96b7af9e5a0a25

SHA512
56b233097b704caea704cac81370ea84d876d13a0db5984d2b63c9bcf7405972765e4699b529b97c4dd29c7b3e48f68abe588b5a3a6e6b7accbd83e3278e44d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
544c58eed2a13b9a80a69af15245d19d

SHA1
d2c3646f19f3a48f1516f02a43b246f4d5ba353b

SHA256
ed4cec25f3dbf19a38533c029fb9b6b4f70d04ad4a15632b6a15c62669d5d4e5

SHA512
e6a47b31bdcc97c4d984bd79fde88a0bdcfc4dae586bcb8d17c2b3a7a8c9edf5f2e8e120237ac6c4009ed1635a778e9e6d902b8c2be735d873a8d11141991bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9253028fcb5dfffb2f5af7f2baeba634

SHA1
83e99411f02a9557ae31fb7ffdeb45d7ca29b156

SHA256
e3cf50437da04f085043777c00bd28efb678e1fa4ca8e783f9ed7245240fb9c6

SHA512
8c1e236711c6fd400d34bd5f3d5eb6de85e63aecf195ca596fd3fd8455d32e983beaefd2466c914ee031e3d6b72d2800b610357de04ed477075db6d40b28424b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57acbb.TMP

Filesize
371B

MD5
61d2c35d7f908fbc397ba645da142c3f

SHA1
98e04ab8a111cc2a144142300d8864f44261eab8

SHA256
3a108a6dbfe948ebd2e6fb59827e6f326374ddc88f656ea8af59c336de7e1841

SHA512
aba62bff7b387c2cf91b4c992d1bbf1738bc6da360866765b9ceb5e1d431d18a5377ffbe60712cd639715f2b5b776dce9894ff695d330af4b5aa35ab62b95e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2649269c7329a6e35a2e34f53daf1ce9

SHA1
1f305287c55176c4b9bd0ba886b67eea71f79f4f

SHA256
b2d87593c55759ca34e06d49634063dc0de0213f7296ee942ad55b019840f889

SHA512
8adb03af078ed2b0f7d27af88293e504c33ba20944f8f2a7ac54d58de47d48e9b0c1fa417f3bf2a41155a03db769feb339a1ed7ae2c8188987c1b6bc28c69ef0

Download Submit