hxxps://updatedsecurity[.]com/topic/9-openssl-vulnerability-cve-2022-3602-cve-2022-3786/

Analysis

max time kernel
208s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://updatedsecurity.com/topic/9-openssl-vulnerability-cve-2022-3602-cve-2022-3786/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-701583114-2636601053-947405450-1000\{072D4B26-BC5E-4624-B4E6-9EAD8A0E3108}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
3084	msedge.exe
3084	msedge.exe
1844	identity_helper.exe
1844	identity_helper.exe
3820	msedge.exe
3820	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1868	3084	msedge.exe	83
PID 3084 wrote to memory of 1868	3084	msedge.exe	83
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 1484	3084	msedge.exe	85
PID 3084 wrote to memory of 5032	3084	msedge.exe	86
PID 3084 wrote to memory of 5032	3084	msedge.exe	86
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87
PID 3084 wrote to memory of 3720	3084	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://updatedsecurity.com/topic/9-openssl-vulnerability-cve-2022-3602-cve-2022-3786/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2b6a46f8,0x7fff2b6a4708,0x7fff2b6a4718
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,12582368565838368640,3437832992759662585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8ab344c5400217ced09b6bce1f9eab9e

SHA1
59c61c404257f8cc13ee29377ab1e410d397891d

SHA256
e4cb119d19d33e06977b33be838d4a7cfade1789cd8291eb9fb2ddc278b93376

SHA512
99cb684c843b092e99c6c4c44b8300b542692ed3e41287fa9fa45fee1f894abec728e815bf672bde4a1fddd870762cf191cee6f3c5e0329b09ca57f8d294dae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
404B

MD5
d043e6c6759669f3023413b4738a7b79

SHA1
46fda07fe1c86d58788ff7f8d97f42cf847f4497

SHA256
1ee2d3a66dc8e975c9013ac8d70279a7a3296e89505dac5da97139c5b6631a3e

SHA512
796222c10836dc85228bca00868fbe9028af454127eef721f36c5f9ef4daed67a5c8428729e6c964103b9f7352b83aaf9a894baa419324e34f597426260b1412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
694B

MD5
3a56c7f9a55b055015e904c7edb4c8d7

SHA1
3a9867627132bf08956f82ca2bcde48a10394755

SHA256
22a744616b94527c8c9392725bd857197df2c38a88492e4aec41be9ef00f1007

SHA512
c4a8991234ab1aa54061ae23a3db400ffcd07d451b8804ce63046f64a0773c354693f3003f0fca7b67b68623336dce87a70377fba8bdf07899f1e9c6d24daf02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cb64f73d65cb16c0799ab2a2f191a4e

SHA1
ae865fcd0536d7e10300b9de43b6d3fcc9ec73ec

SHA256
0d45d467079fd6d08191743a13c21d5d78db5db79866cf4c9e8613e48f493972

SHA512
2f8a49939cc472e9c18989ab4c05f55862c24cebe88bb79ab81c0298309b276ce9a584f60a778bacf18f6d0e5e44b580513bdf86e48356935ad4580c5acffa68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b46f172257132a8d5b5e0fdc3b172f0

SHA1
e535212086f940288d7bd2ead4a79d2704b1c9f1

SHA256
692c70b50aef9a2ef8cf0b243d5923596d1f835b466d70a18db0d5218d199f7c

SHA512
5b30cacccbfc9137a3659f7e974f2d0487d1890165c0f4281c029950ecad16e1ae4a44a6ab5b42fc4e113c4bf47980e1d924a5ab80e154fbf12b347783298b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d02852e9a8d3da6002f14d0b2248c3d0

SHA1
4438b4466e975db3ebeaddb8b8ff8bd39f496aae

SHA256
626bf0b4f45ac478402c6d834753f2026174036bf35f14246cfe0f2f8c4176cd

SHA512
ac29e8112b0ca3493057b60d0546837dfc1ad6bc75e47d56e947a43e3006bf6048fde93d4f14888a08e303c35cc8d1798ac529081b670cb1fdbdd05919e534fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3621af567c65de26eb610c645d842f83

SHA1
01f348861a4612c147dc30052099d8d588840662

SHA256
173a7a9dbaef5b8d4fa51663e10f24ce97ecaad181c335202e15c12a92afdc90

SHA512
13884c467a0d5049cd6d0959fff54e2e473687873fe547541e85c88ebba7ca090dc35da1e2b59e7a752ee6c19c25fd5864171eac9d5f83c70b426ea1f3bffa25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
140f344d3997c079eb34d9c56c0b6042

SHA1
190317078e26df0c65b27ac719e07c6bc3c753aa

SHA256
868c05383a3ce5dbdde60f5d52cf683f57bc87578f67a1780545ac0bfb7b6248

SHA512
1108847f02dd0ea7c03dedee76d57df35d899ec1d526056441f57fba14cac7e505d8de007c1af55f6fb8b591d3f6a66a572477537d5e1f2c688b85ad76ee1bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
c3e41c73e4bf52cf312c6dee58594671

SHA1
aa392e0bfb41cc6bd371f6ea99a28ce59d861cd3

SHA256
fd16a630d08a46f91d914b32649710cd479089b34a451da3c4085a233852ea0f

SHA512
670965083d8493a64d2a9ab8040dff7a4ab8b9f626ed844072332f0b192fa6a69f5b6d11a296cb1427f91d654fc3c25856e6e5af1c5bc92d96c2ad7f4bdb27da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b0bd.TMP

Filesize
201B

MD5
948ac069ea23ea0a3cce91a556345898

SHA1
516b9cb73387e00fa6ba820413336b6a0ab6abac

SHA256
a680ee81a65b784afef5c42564539259016949a9369416a1aa5f3760883267ec

SHA512
8021b6913361f75bd1d81328c5e0c7a6281cd20a8491717a9b9603710291583a23e48022e583090e7ba9abdf2e9bccd365961047e8f3c3f5f6948650216d446b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a8e309bd2b454f5be224526b558d41bf

SHA1
92d58cfc419e4c0a2a2896235764d3b08c238200

SHA256
dfe8a9a530066f733c9ab2d97e9f21842bb8d604042914a9c71526a216112f12

SHA512
b1a51bc872e27dc84ab257951dbb16e30faabddbcf48c704368a96ec3f1ed773fe030f89b8af8e037903e4fb2aa37f5f0b0e4cd3989c009bac7fdc870915ccd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e95c0550d8fb86396fcffd159b7e71d9

SHA1
ef4c080087381483dc607a38bea6a84176e56b5e

SHA256
dc556d171f65e95450cd8112469cdb2a9a0d5d874914d37dec6aabe7d38434c3

SHA512
af885f0116f537ce1585a26f7e256c47784364011967417931f44431d550abad87839e2d15e812d0918801171448fdd2d24eb4e70965dbc4f59fa6cffe370def

Download Submit