hxxp://aka[.]ms/remoteconnect

Resubmissions

01/04/2024, 01:10

240401-bjj2hshf54 5

01/04/2024, 01:08

240401-bhltqahb9w 7

Analysis

max time kernel
171s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://aka.ms/remoteconnect

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
1080	msedge.exe
1080	msedge.exe
3996	identity_helper.exe
3996	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3564	1080	msedge.exe	85
PID 1080 wrote to memory of 3564	1080	msedge.exe	85
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 4388	1080	msedge.exe	86
PID 1080 wrote to memory of 2124	1080	msedge.exe	87
PID 1080 wrote to memory of 2124	1080	msedge.exe	87
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88
PID 1080 wrote to memory of 1008	1080	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://aka.ms/remoteconnect
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98d6a46f8,0x7ff98d6a4708,0x7ff98d6a4718
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5532 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1336 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10213418205546403441,7959472940157970343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\781b782b-eb61-4678-8e77-eae4fb447310.tmp

Filesize
539B

MD5
78650f2f333a7360a7ebb48e32276a94

SHA1
c5dedb20cf6233c127d6618a959f75a619e34ee9

SHA256
e9f812b40cf32ff50e2b98ab59e21e8a8a82a4e5a6ac51991f6b0ed98ca3017c

SHA512
dec9c6e1d3dfde5e302a302c1d605578e6ee3143faa51dc297807a4142f22941b63aede134e7be60cef8f94524bf36f0dc03dec2447e45de5d6e4717bc06fe3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
19KB

MD5
a130f0979eb8f2893b4e44263a40caf9

SHA1
dff401dac339cd0181b4e8129e1873f48bcfc342

SHA256
fb6270bcca87411adfb7d3e67ddbc1d4970f895555a0e34f6d4a70be96a0e006

SHA512
3176ed93f4af696f5b64a6846b51011e6c7d1455ffa1f8c7515c710b98486c8f5f0d1c96683e73c1373e1b13896efc3b6d180c01d7f2a60ced3405f2355cee45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
59KB

MD5
c1e82bf71add622ad0f3bf8572f634fc

SHA1
6ca863d4cab96669202548d301693b3f5f80b0d5

SHA256
ba48af15d297db450dc4870242482145addb2d18375a4871c490429e2dc5464a

SHA512
820a7f8a0c8ea33a8fe1e90cdc35f45dc1e143e836b0d8ea047e1e312f8caec72cdee4e7db54760a4d749cd0acfe103a27e39a9a56eb2d704e448a67b0d0c079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
31KB

MD5
b3df30ae70c34bac95fc91544d9209bd

SHA1
68e1316de3cd5feebcb4da17afc80eafd7fb2234

SHA256
b06f7f7c91da1e7a195a508913008e0427889447b9697e090cc8adc7d4e6564e

SHA512
e209cf0223ebe5fda949e721cb6794b7ff9173b95bc2b28fa5b70b576dd03ad36dcced5b1c4764571c8cb1cf0b7fb965f1835dc9b3cb7a7afa8b3c4ce684a7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
236KB

MD5
b46031e02b69c55b43053aedc00e59af

SHA1
3b4f355a7ea1d6f0da5f117335499489868087d7

SHA256
296d5be0236dcc1d7ff8d3d17a47a698c0d51968c9e4907123f88e21c14e0840

SHA512
a4fd995debf4369f826dd4320c169394a6c76e65036410261bd00e025682195847f9e26f6b498e90fccc7b054f52af277cd17944f14e050bc930e3d47c8a87bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
106d1b133e06d0fb2976056d56a5d213

SHA1
046ba128845dace2d50f1fb0168612408a7c59ef

SHA256
87cfb5f594e5e52cacc99f79e74b8cb2c20d3621cf399b451c1e1c533334d50a

SHA512
4070ea8aad13bcb1c12b810ddee4ae70a30628701e16cf420c84f12a00d0e51152b53b11dd6f9be935f63950167c5616868eabd5bc8e76618782758ed029a0c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
fea026f60f4eb9314eaf7dd99b171d40

SHA1
cdad08f0bfba3106bb6c28a5cb1cc38c99c7ea9b

SHA256
8359ca286e719dec821f61876bc163f4fb158d1b80fab9fdf357c7c9491ad662

SHA512
bcf1fd91be3d0fd3d0d663ee10b48640c89430fe77c4832b43db84fe1e12c4c6ea724010b0d3932f5e36e653f4a58459b8d27e33c244a7026e3b23d60d3ce906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
428B

MD5
33fff4d195e3eb581d965eff895e5754

SHA1
2f1254a53d47be7898da72d019a396fa16139ecd

SHA256
63744f4da55553280dfa7676af2c2343073fa23e5efe5d48983b8a04bf87df6c

SHA512
1654335880fcd13dfc36695cb1c7af4c7181126b06d3de335718f9c2beb97fcebaef13fb761145cc65a4e605fb0e1e48a4c6567e20a01e664f49d4b6f8a0c681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
648B

MD5
c4c86b9fe9d2d7d170c109edbe2d4e3c

SHA1
1c9612c458d47b406bdf28d574ce1b7a2ce70775

SHA256
6d4f6eccd3ca0dff7334e863d5949941c3b5ec29f22e79f03c2b7c49f952c4be

SHA512
4609cea349d5529a7f21042dd7c3cc241564e3299ee9f20a0be48908bf3930ec04bb3b34c8809a371b186441c2e262866f137246928e82671f25c9d2a675c82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
575e65836bbff6ef4d0e246afcd6201e

SHA1
64506e6e1345e7b5abe1bf2c07a22fcc2eb23ddb

SHA256
af12332d30cc1c752dbac80811392a42da76b0cfb497e81dbbc2cfe4564d4847

SHA512
e96f8e3dddf196cbc1b00fdc901ca66c7303b53fe2e8ea7f87a9304e178556c7aaad5cf1b2723bc73be625f1251b1edf5142e19292057685f952110d989d7c6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
afc3ae9dcc1dd29137b3e636e6cdf5bf

SHA1
bd1f22a11e518443cae4eb0630b9e53bd3ddea96

SHA256
5d8071ce194eb9d7d012e4be297e8b4ccdf9a604f1a6fa7bd532bd243cdcbad7

SHA512
475c6023ff2880ca3a1cb97dee4021040d4f79aa64bc2f9eddbdb14f9f40016b6b9a15bac9fbac811a206c1490836080a46b0771ab2d2e757ca6ef15b6c6529d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e05bfad6f697f8f3ba7f5ab2f316908e

SHA1
ff44518efe9253a87cd971ede8b778cb304e3971

SHA256
ab1a06871c3eab0869b8462af17c912cb7cd582ff089c4629acc83312941dbef

SHA512
2a89d1b6119d727912fd7c0ddf1507f799de9dc3d37d327c133577b44986a3dd67dd681476970597e77aabb0d3eefb22a8d76f75552902437b44603ff99de23f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11074db66b1f7c4eab57ebd9f544b989

SHA1
76e23ed77a0e8e86506216f5eb3afdeddec09d0f

SHA256
ef6b00b2a6e403b4b52dcce1598f65a86b9a4b78b4e460456272d042c3db7ca5

SHA512
5a365c64b99f5c212c0c9fa645b279cd941fd72dd12b38bfaff487a012da828e1fb3fbf60c3512fc7422c900b0b42b001289c01a93af3f65f438166e18f7a4d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2be2baa137ec7f5528786a96c01a3d4

SHA1
960630dcc450b4946410e942c02e6db0d3ce3184

SHA256
5bd1f93efd08f985954a956ff15df87980789844540d523b55b3a1ba63d502c7

SHA512
a29d38b833272c756585682cd4354c418902a3dc5dcd6778221f924b824986d548201830ff81994f68f2b4003600664bf1ec49220bc9ae73adf470b8677cc81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
52376a8ba77890d085cb22c88213ad54

SHA1
46d3bb10e3171484273ab4c70e86ec881dac8d7a

SHA256
276c5777f6e8e3d8405537c9e934d14239d9dfa22977d8f574880c835f904a23

SHA512
e737cae8c5ce1322c4b786eb19893840c9df1233e6b297697d71da7951c1036ff67af510330e72288c7b9603cb3dd7f14875f7fff56c046d671a59528fbd42f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4968ac6549beb47278bad48960f933e9

SHA1
e58c67293e73f8bffa47cb5994b8fcd0d651232a

SHA256
60fb4fd7e62cdad29cb227e6b1089255a39ceaddf79268e05c6fae92f58a97fe

SHA512
ac828211d0bf02a66755c167f88111baf1d0d516653076362e76612dc42133850b43b68211961414b2993897081d87da4b6edc0a578cb508325b6e567767989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf12dbd9cdf71fd3aeccceee5b4cc5c2

SHA1
bb3f46fd9103558c1fe3b2ec68a08bc56d14c82c

SHA256
b38b74707bb10d34bc88098cd05c06df787091c093755b4602736a54551bcfd2

SHA512
0933efedd6847a1694de442f1cf0114dcde70826451e437472e5965b84b8350899cd2c147d84aa2d6bcddc8ba737bf775175b6a882dcf8d831c2440f08a2b8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b45c5283a1f7e8a6c1632699cfce3f03

SHA1
2b3f7c76de2a083fc496d797f02fd6b1d77a726d

SHA256
2d063048678956de2d5ffbbf1858163b0db545b2052142e4c96bf34a6cf2207a

SHA512
2bf94f1c3b55b3f5aad9269f5321ed6061c6c6df85c8c1a63a2631226a48d4c69567e9c3e58b0b74636ebe6e6edd49a3ef9be0d950d454ef96abb651fa1bbb96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6ff3e8fd9e53435c5c460ce37ae30170

SHA1
9d963542a17269bdfeb8e493c875bc09197535ac

SHA256
c2ba1569ce4ea96be601ed3af4eba609c4b20df924b6e9de8ad70f7a1675a0da

SHA512
4c532f5b7562a632c65c22c8ed53621b8e2f728fa46850bb8eaab951335f97692725bdbc6217a98a735089bd629df004128cb80dff03102db7af456681a1ec83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
73b15b62f118b23525fb4882b80c9de1

SHA1
76dca3cd7efba62bc994c617328f196344202b24

SHA256
550e3151afa68eaea19cd1d77eadfc42cea8333c1ff13a474f4fd7577c799e62

SHA512
9eec707ba92ae56a5a606d600c7e94830dca454914a7c72c2280360fe0b911a233973884bc1c579ee5388d1e7903a91140f57a712f7bb615ee6fa66e24b64a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
d3a7ec9528adb2e87ab50524e6ab755f

SHA1
a12d622466112a60377ebf0f81347bd4f9558833

SHA256
d7daf15b199b96a7a5715a62cec98868d0a5024007843756935e243d10aa258f

SHA512
f1885371ffd3fe18a79b0020c679bbc31c0a139cd4f6c9d8511d54947f925a13508416f712c7dba01159d9d5cc757b27b0f04f044ce9a7e676d6a35a8fbae9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
c5bb423f199da79c6bc37370da4e3d66

SHA1
0c4309eeca56ffdd1d3d86e578df08ae0c74e20d

SHA256
f680bdba225bf95a140bf41ba684cc8b4c4f342187aefe2403fa5bfd0a0933d3

SHA512
9fb9dad31b56cd7482a8d70a0d4b8bf623ee3a53ee16b687d76f16807626864ef7ece1b77968a0f16559778692caf8b339250cd1137462ddfeece892277af9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
7755b89b517d76fff734a879fc42e6fa

SHA1
05dd0f0b2430b6e17d92cd8d35c5154181038320

SHA256
d5734c7449fe63ec316820afa08c0bcedd12ff8b824f7b4cb165c4f481084d09

SHA512
afd10211786f4697be909760f8b386d15808c74c9a45eba5230fc6f01474cc8ab37d77e667d5fa6331a9bd8b9897635ae24f3292b75ef797b29c0eb64951a372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
40d60adc775d02ec67b48c50f41c7f58

SHA1
9df3f20144da85559e342e170ba8424c59d4cded

SHA256
42c12a25bb267a31b0b26ac9637e5ac2b1f6e0f847ea52c7be4bd799314107a2

SHA512
c76d23e6c51b6ba4b26763a947b8db9902a776e8dbe66497d78418558acc03ae37550a3579c9a46e2d6fa65401760786aa4ef6438d565b6960a4786dccc16f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
b0da849312af274a3a3b0152d8bea20c

SHA1
62c6b9f16398c1bc9fce4bf5bc83f3a53257bbc8

SHA256
15e7ec272d0016c1e4de03b392cb1e5f9baac341131c6f69d68b14f1839e8c60

SHA512
dbe8a5b15f1e05ac25d0700e8f1575fcc65905db3865db50ce5bab2a16a2803dc5c5a96a1ba46b3bdc36250c27a297ee955f4b95d6a7af9544f6124641daaa34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
94778a54010c1f4e394d59a990f4a494

SHA1
7e25959bbcd18b343ccd2e1810ed02ec497689e9

SHA256
2b338ea143eac7bec2147b699cd5a5d153cdd9034333d504ef4e52cf6bbc1580

SHA512
0e2d12caa5d3c24a0e83cf498aefd920708bf26a147ae46a3305502e1618b2a1936ee5c7660ed3cc9f1c4632eb43c58f1b53320a8ea9ebf1b7e922322dbe0f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb70.TMP

Filesize
204B

MD5
5ec385cd11c2a88792b23e3b127935ba

SHA1
3a5d2aac2d2f3a552d062f0f0461b2cb2e1fb44a

SHA256
0505eb02c67236e2d52bf275f2e48f30a826df6b91b2918717735df14e2ac911

SHA512
15725e4adacab160385586e180ea58f747047cf7e10afa9fbe7975224aebcf6f80865b246975887f95337766b12189f135646741878a4bbf78a7285449ed4e95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f3fcc9da-4028-4e30-b695-15a8f0c7ed29.tmp

Filesize
372B

MD5
25371d47501a31b5f08ef6cb695e8fa8

SHA1
7efd30036bbd8ae49731adc85a5c1919740e79c7

SHA256
5a810c515aaaecfac64fb791daf1bbe27d1aeca99212e4a1a4e344f6091cfb3e

SHA512
a89e821ca6763647f5771735b20676a133aece85f744132d7c194b80a0b64f02e481663c5f87d633ad38642a0f389714d1a33f5cf93814818cfbac35c0afd867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28ef3a1d30471287ef78538ff8b2c1da

SHA1
1abe0a7df7b03533d94ece9a86979194423c853b

SHA256
90c397d60bf76470b0c823d27c9be99dec25def40fcac66973e7281ac6483bef

SHA512
b1cc6c878ece2c844f0b370dd241a6c29923f9789df39216177ff75abd6719cbad0487ca1594daf377d938040fa66e32417ac7e9776c353818d318175d00f35e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit