hxxps://t[.]microsoftstore2[.]microsoft[.]com/r/?id=h4b12b3e7,f2ea623,f2ea9ac&e=b2NpZD1BSURfZW1hX1BST19TRTIxMTExJTVFR2hvc3RfQ2lwaGVyX0NvbnRyb2xsZXIlNUVrb19LUg&s=v6Irz4g-IQAsehhRm5GP5t9m2FtW6djbyYWzVViUUsI

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.microsoftstore2.microsoft.com/r/?id=h4b12b3e7,f2ea623,f2ea9ac&e=b2NpZD1BSURfZW1hX1BST19TRTIxMTExJTVFR2hvc3RfQ2lwaGVyX0NvbnRyb2xsZXIlNUVrb19LUg&s=v6Irz4g-IQAsehhRm5GP5t9m2FtW6djbyYWzVViUUsI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
4364	msedge.exe
4364	msedge.exe
3460	identity_helper.exe
3460	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4732	4364	msedge.exe	81
PID 4364 wrote to memory of 4732	4364	msedge.exe	81
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1420	4364	msedge.exe	82
PID 4364 wrote to memory of 1648	4364	msedge.exe	83
PID 4364 wrote to memory of 1648	4364	msedge.exe	83
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84
PID 4364 wrote to memory of 3600	4364	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.microsoftstore2.microsoft.com/r/?id=h4b12b3e7,f2ea623,f2ea9ac&e=b2NpZD1BSURfZW1hX1BST19TRTIxMTExJTVFR2hvc3RfQ2lwaGVyX0NvbnRyb2xsZXIlNUVrb19LUg&s=v6Irz4g-IQAsehhRm5GP5t9m2FtW6djbyYWzVViUUsI
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb579346f8,0x7ffb57934708,0x7ffb57934718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12205452530932724475,14090452781784266031,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
037baa5f3163f179e54fc167a761c904

SHA1
18d23d3474133babfb3ac1e855caf9e1fa5e453e

SHA256
9b78149e648cb4a3c2d9bb37b859ac3d1cc6de5be3f18f51104428045edea24a

SHA512
1dd7180d391fcc276bb6395a2640b5582abf6f840892e1d55e1565d2826c557ea35be5b10d99cc904ce794e1466110061b4c6fc816b049604851ead88def9a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
af4a0791ad81ac06524cc2f16a50736d

SHA1
cf76a931c5e958789b76f6e95ea7f406605268ed

SHA256
e0bc07890ea85b8f8504bb7e9fd43d4baab8d133b5422029ea27b6acfcfca0fc

SHA512
38f49b28a9f30cfa7b2dabc4f072cc524ce1937d3a38317ebabd6440c46dde6e5c2549405a56f7ec902dce50afb61d0e696e47f117e7a8a1c8764a991a30938a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
008062f335b365df8b772065c93662fc

SHA1
1fccf03ab3563f123633cf24f9344b9f49da5eac

SHA256
db3d3e291eee749c4e82a0d2e250f93df7e8c413c900c0cce30bc82d1e4f5091

SHA512
1350ddcb744128bcaabfc4bbaf4e4114d64ff98b207e81787279222e7b67c6cf81612539bfc2e58356405d474434c4ab4f5af872a6b50590b08f07064b747a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
be4ccc452ec577b50886ffb9909a4ddc

SHA1
0f8dd73bb8211b221b675319007e0909ebd3a1b1

SHA256
e2a0cb3efc6854f9437ac859ea93dc3e33608a1a2cefd780ee08f076c004b790

SHA512
aa41e548b1a954463ca7585567dbacb9e67f1db079a83d2206a1ebf5bc8979a8327d35b4ab1e7103999db30cc7e914ce323df45184460e41f126b91a0ad2991d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
e60cd9f425140b3c81ae0e549f90cbfe

SHA1
f3098f84937b91c5954504fec4f5c4136242fb2b

SHA256
f063e6f14561d08034eaf402a6382c63ade3ed11ef7aa3c31db4831326eeef1a

SHA512
e3dc38f2a9cec6439baa590874c366c1748646ac6e110009d577ed8cdc527a11569ec7eeb45958c78ff213bccd26f703f27e5ad3f817824dd706c15565b50c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9072d5570103be1aaca1b4e1d23d7955

SHA1
c6c65c9c16dac59894b2788f7b548365a6332fdd

SHA256
2717da7652249a86ce029560be305a89d42ad866fe25b221345b02802a06d19d

SHA512
a472146733886c710c388ef648059f4a42fd5001f355cf716c8bab43150aeae1f9d5107b91f47bdc478d3643f53715bac16860ebbb0e744a137dda95037b5677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0c3f83e240de0ec9d642705aad6a677e

SHA1
dc109cc9d5fbee99e9f385947a71566d42abdca4

SHA256
3c11e774c71c0eba4787c8460a7c2d03fc619b70f0d351ceab22f7af19847638

SHA512
dc929f80f05e75542bd6d9fe1c9550cd64c1a05b2d10ac8ec0a0e990db86a49e687218e913bb5dcff2abf75579a71d360b63cd6610b32d3d0c5d0fdcf1d889ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f89a103d323e98ad2295b47a4ead1fc2

SHA1
b74c4063354dbf1ee30af7b1b1f3a1a9620bc0fe

SHA256
193135ab0bc07f67aa5d00a81d0a9213ebd1de2ba677971af22d15a61dabe40a

SHA512
6f5740a5b9973613ac3f79ab10345483c2342fa371033499023baca0f1a793b9f51bbe285d60c4313c7b18a45b21e62703f3632161d122713df0e63156406ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b01f99ac829eba516ca72b981daa533f

SHA1
57fb3ff2190fa10aa6ac434375eb96ac03b7ed95

SHA256
a50e7798a7c8e8cbc0100e5f99acf905f27caeb3a175219fba147886cabf5694

SHA512
dc619462e933e555e6341e0fe4c8b3f2e05ead4382b9733887ec70cdf6bee4db078d59079dcbe7a1c945ce403eb707ff15cac649f649fa2ea7fb9d16b6d3334e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d557ead9fabaf293d9aa83dbf908a11a

SHA1
20e63228502f68bdd81d74c6af1e88bd1f1cd9e6

SHA256
8917327f2381bea8fb6b966260e022218770b35ff3d9aa26e6c542d8ef7b3c7c

SHA512
a7542ff5c24c111a6831c644916a93bed4da8fb0d304b2a5b6db31961cc5e1a422925968f6b9ae4557469dc9f4e11433915d5b8e2090e04c8607f407cc5b4d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
42f263b87a89700bb40e940ea966564d

SHA1
1b900354f2c963f27e4fd0818886400491eb6cd7

SHA256
c3a00b49709675a8e5c4068d0e016a1ff68d417c6097b4b57d23056e58e3812f

SHA512
d8660e5f5c56ee95a3bf54eb065202b04149247030498dc0f6dd6ad68fca480bb2cc07e2405b4e54daaf7b0ee1e0f526ba51b6a02a664c6190efb127b4ed7d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585416.TMP

Filesize
1KB

MD5
2fc16ffe7ce9281a47b14a7a4dbc4068

SHA1
1710b9236015f8256e4025cb40ac93818cadfb45

SHA256
9a8c70be616113284ddd417366d10d86c7adc1fd0bbbf48633938344a890ace9

SHA512
58900b6f8525c3db528a06c6023299ba05715b27c5ec255b1a913a5e75126aa14fd7c065fbdcf2fed20d94ea02536b5c911325876329d093c74a031736078a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5777210a453140bee6761b24eb8a5458

SHA1
b2a4143a7dcbdb64900438bd9ac2c90ad4b00333

SHA256
2ed8c0ea30a0a0c3605d2e532fe56c70070688b4c05c427e2ff383354e11c83a

SHA512
d316f86ab9a966ecb14314896b22bb193a51d8b9aae4783c1c979d2c32146c38676efdbb49203d974d483f83f430cabf16aa4e9b87874755fb895d5893800002

Download Submit