9fd953b646489e95a79b1deb7936e89c52eca943c99722e7b9f985a50c449b1d

Analysis

max time kernel
151s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3004-54-0x0000000000220000-0x0000000000250000-memory.exe
Size

192KB
MD5

e32298d461fa5bf348bd36358d8eaa5f
SHA1

eb6d84dabe33d9b1c07614b298ec884b477a6330
SHA256

9fd953b646489e95a79b1deb7936e89c52eca943c99722e7b9f985a50c449b1d
SHA512

7354d1abca4c6fca18fbeb91c56860093f83f2f56fc1c21c033293526a30fb628268866aa92ab0a6d29458dc21b238f64bf4694bc59ee190d977ddb26d8525a7
SSDEEP

1536:RI3qDrnv36sv0W7ToK64rH1dXhQLnuVIg9BHixNNVYQbxbuwH3oKd1z50GkRK8eL:eQ7dlhdCLnKLBHixN0I3441z5l8e8he

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
796	msedge.exe
796	msedge.exe
1300	msedge.exe
1300	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1300	1936	3004-54-0x0000000000220000-0x0000000000250000-memory.exe	90
PID 1936 wrote to memory of 1300	1936	3004-54-0x0000000000220000-0x0000000000250000-memory.exe	90
PID 1300 wrote to memory of 764	1300	msedge.exe	91
PID 1300 wrote to memory of 764	1300	msedge.exe	91
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 4908	1300	msedge.exe	93
PID 1300 wrote to memory of 796	1300	msedge.exe	94
PID 1300 wrote to memory of 796	1300	msedge.exe	94
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95
PID 1300 wrote to memory of 3516	1300	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\3004-54-0x0000000000220000-0x0000000000250000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3004-54-0x0000000000220000-0x0000000000250000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3004-54-0x0000000000220000-0x0000000000250000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84a4a46f8,0x7ff84a4a4708,0x7ff84a4a4718
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1095389090012630209,4636945189113129848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4268 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3004-54-0x0000000000220000-0x0000000000250000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84a4a46f8,0x7ff84a4a4708,0x7ff84a4a4718
    3⤵
    PID:3296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b09c5c4a0acda5da717ff54ea3bcb684

SHA1
d83512c845997c3f308d93e6fa8101cc497123a6

SHA256
2fbd17abd49864e099b4868ebe962976a7af4703bdc42f67b6b4a725d476ba8e

SHA512
4ab71a9116e3c27e0114c7aa166f059a4fc0349d6d4d72607109428b7a04b3fc521a5e17e4a6afbf67b49348929e4ffb5a0a256fa74aa16e5c0efb34ab16bc11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
1fb226df076cee8ac549ee96124f8073

SHA1
59e5f8caa2adf44ab79ec06421a1d2c71f7fc80f

SHA256
9f3da95b6ea8b6a1184362417d2962440cd6dc378f2edc88d45ba511ad3b4aae

SHA512
f71f1c8848f2a08620b40bd8b2d27f0cb7b0437b0ba1e024757ac77f7868c4c06793b5fc6a7100578fe5c54e8079602aebe07caef8013ed18f83a99e51fb8958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3940e2ac1949fdf171f346de62fcbfd9

SHA1
fcbc2a31e49f28bd326660d9d5b01a488151e547

SHA256
d96630fafa8a2cfc2f3150c83118a04816f1a538c24fa80e2a0073690bba0dbb

SHA512
a3c3b743c4eea747bc98bb4bddb9dc2e35cb120d759818d4757bff9da45765562cf276d3c5d9196b17ddb02eb0ed33ad77643887450df9d4c0eb2ecbffa42e15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e57d5b1fac485ab4ed24ae3c43b6512e

SHA1
f124427bc29e2e2775282bacee2b5227fe30a686

SHA256
efa06622ba0660c7b5b59f36611f21671bafb820a0354fff8576cedc0daddc20

SHA512
a4516d1574e6b0df23dff8e20643be0c655947ae199a9be28240ba06761cde16fecff5be139b094ec99d2f440ac647d7081c80fb09549461709257decc69b908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
010e5f68fabc8b764ef811f70760aa92

SHA1
dc100222d36fca0d4369599e7214f1e689c5a422

SHA256
555b62150c6fd447bb3710a6a4c5a4fb7272b0707c45240c55e4b5617cd73cb4

SHA512
fcc0a801a5680c30db1d81e5e28e2c3491ef5473dfb355a3c07a1d080036c8399c0da6f1919ac3263557d07f66c403537b7ba907d46bc9aeaf092ed39b21e5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e5c7b1c6976e715074cf9ea9544196aa

SHA1
f62ddd39d0a38ee09e4cf1e89e8b5c6c5b51e12d

SHA256
6d21c490b0a57af1cc374ed6add4ce0fa4c0db2caf60c22942eba6f1037a746f

SHA512
1d1b546f7c49f47d398e27aff0e27900c645d01d8de01c745d159793be9992cdc0d11b17cc74e3680edcee501ed175228db1e2f85fb7989cc9ae35abc747f599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
a98add925754d2caefe9b3a7015f6322

SHA1
723c69800b3fd6d5d5b3ec18ada60dcb03da54ea

SHA256
ba12fa6f6cd15405f25c00ee7338b21016a2c4c2e7be937c561998c3968182e6

SHA512
e21114ba0ef879233041721060332b7ec2825904840e106c886b5bc26c3b74a74f280ab6c0605aac3eb0e0487c2ad1a83588a57681eec9d31c6afeb741e6014f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
91a2001944723e5943ff120f4bea3d5d

SHA1
71d2ea2ceeadc3084ef00850ac96c7bc0c4f143f

SHA256
04be70f6fb930c62861277ebb2ed058a685fdd6e0fd77960ad16123d59ca4c2f

SHA512
0590102a95d353bdd951efc7d259c6efa407bb782ff0653d11c1e9aef5fe1c23f2c0f598a2b385fb5e57f5fd0abbce788f68426b1c5893ae9ebca666deebac57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581018.TMP

Filesize
203B

MD5
b6dd6147b703b76d16b4290ebd1a135e

SHA1
dc959a7076efdf2aeeb74bab68930ceb7cee4e63

SHA256
ec8e24ef9e41c9220195da1af190ab0ddd59881c8be8606971f6c9a519c205c1

SHA512
577f021deed17de2a174aa88c4c1f8c692a5e46c50a3d1ed897108f74ff8f112a7fcdbd75b2f6498a19e46db7ea2fb5ef0070e7bba56f71a0ce5d9424218fb33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8fcbfc7228c3a65fd6ea74b2b8f9e69e

SHA1
b5d8a590595f28d01ea9142167ee1d7a8aaa5996

SHA256
c107c11ba46eb7cbef7a58de285819b36740e70e198da25407a8898f772e2bb4

SHA512
2780adc312060aa0ddee43520441cbcaaea8f9c430d6ddb0a077b97c5ee178c7c7e8f8976f3602509b27b9b85c0da15676df04b74fe7927b3372ae109fd2c0b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9248fea3ec01f441e12075ba9fee7a5

SHA1
5a394dff52fe23ed8aeb8672ea451e1f51453021

SHA256
577e9d28ddefd2e73d814fa1effb9d8c3b2a6346b2bc57c1dc8e2dccd8f65e3b

SHA512
5d8826d3a7bcbeb210d58fcc014e0912859622c1594ebc3149f0f26432fd7f8ec5ed3f26ac4989bee0cded4819c2ba605ec9a0af5a7c0ecbe31196af2e21d217

Download Submit