hxxps://816b462f[.]5880c482d0a3061180a519e9[.]workers[.]dev/?qrc=abc@test[.]com

Resubmissions

18/10/2024, 08:45

241018-knxmvazgjp 8

18/10/2024, 08:37

18/10/2024, 08:36

18/10/2024, 07:54

18/10/2024, 07:44

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://816b462f.5880c482d0a3061180a519e9.workers.dev/[email protected]

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
392	msedge.exe
392	msedge.exe
4068	identity_helper.exe
4068	identity_helper.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1096	392	msedge.exe	84
PID 392 wrote to memory of 1096	392	msedge.exe	84
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 2512	392	msedge.exe	85
PID 392 wrote to memory of 1772	392	msedge.exe	86
PID 392 wrote to memory of 1772	392	msedge.exe	86
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87
PID 392 wrote to memory of 4316	392	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://816b462f.5880c482d0a3061180a519e9.workers.dev/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfcd946f8,0x7ffcfcd94708,0x7ffcfcd94718
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9126445811838871665,16778321268856885017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
1b2fad539c3d3d8ffac268120caaeecb

SHA1
110a0a02ebacb9187082a97feb683a4b44ac58ba

SHA256
344876c5b3c4632b42e5542940266b00c9d70e040ae7c259ced1f8c91b8d9f34

SHA512
d2fbc3224ce2625ec3dbd92fc3d26bc3dfbf9104204e79d2faebb50d916c1b92d8e3cbb12b2b684e29195f551dddf7d688aa30e91a56d99fd2d7a0bd7f0497b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d23a0318c70192e1f69926af9b76a85a

SHA1
9db3bf98a4860ee213f575a604ac902c45e99391

SHA256
66d214b569dd44510d20bb047c86b5ca1c0e98ddefadaca27deb6e0a4840a35b

SHA512
3d3af47ad2c9c5fda792d53a59a19b1b16d6307bc096f38a0dfe47634512ce74afe4a5f11087744f3ab49b91ca95dd56d5f67324d4b409c6834092aab2c1e2f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
979B

MD5
b536b3f5d33ca43d4f2903397074e839

SHA1
c234c41c2efa8b54d5f939efa59bc161151460d5

SHA256
baf75d0817523dbe7015c8f3436a796194f0c7fa722476501fc1b440f47d13a3

SHA512
68fc24f0ef46293ce3cd02df4b04e9639d935ea2e62c020f0d4cb3739ab445555d856b63888a80784e957ea02801303e1f0cf8c5ac273a5018c127c3375b1f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
296B

MD5
0d0932996e14604f2bf56eaafc718dc4

SHA1
08f106474fa0c9490ee925c0e10ab8b69bcb08d8

SHA256
b13a229e246f41546cc14ecdeffd4300fd53488f2f73e0954d601a61a0aa1994

SHA512
801fd3e1d8e11deaacd5d8530a9412f9c80ee7b663ffbc9b0f9ec9c471e5981aa373f6046a3144cf094e53021d487e543a93538b8afb27c1d6663d603c433059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d5b51ca7a6e7074993bc3cdada5837dd

SHA1
6f56a756d770c102e704a4345976af2703b9f71a

SHA256
ec96db16e91462a58aec9539dd6b87c82ce0bcc7bba30625e9d3b7c5aab7d64e

SHA512
1c6bb9c7320b0442d58d5c99d02418fb50747e53bd7b42254a5951468b405997a9d9e8415bb15b354533a3befbe8f231c180cae5bcec2f89b0754e55b390e930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
867b2400689d2349ed55da2673c5098a

SHA1
5bcbe27b5242b2f9f02606a6a156232678029c4b

SHA256
77fe4070a5e2efe3792952a7a08d6bd56c3c35d9feac1fe58fe86efe3e7c6a8a

SHA512
f57b838ac61397f1dd541332be20b49b5022666d55ecf5816af3bafe6a2d22312ebabb20c9d8b49fed8a3230f4614f5f3f8ea815cc85e833daf7b5757e0924f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5cdb3884a710265c41b1fab63d227018

SHA1
8a17d38ceed444674313c41e004ce3e912c2e122

SHA256
8b902f7456bd12e7fd5df9dc4d657ab7ebac1c60b267e50e8b68b3f115c87856

SHA512
da25dc4a48573b4c74627f4efd4d5643f0b8d8fbd4d673d7dbf3316ba407ea9accbd74df95da9afdfa9c3cc8d4c9a1e2b40050dbe127c88900ead38f533871c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48c11ca1a477ae0d0ff65face88983be

SHA1
f687874e4faec51af71219bca2484b122b018afc

SHA256
534fd4388900b332a19b8281a7ec40bda950733525ae040726a5660e9652022a

SHA512
856cd4961d5311e3b4a746661229dd735f6aca384c76ddb82cbf34494d14243443bdec4e0d126e33df4244e784854acdcf0fafdbc73d8b1abb0fa6bea5201d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2bbe65adc19448e5cffc3a6a7e810d1d

SHA1
7a5c2b22b427c6bef68beb7193b1871098843a26

SHA256
5b66bf3b156d7b3bf7ebe2132fde74ddf86aff364fcf63046e1e600211b19509

SHA512
dbfc5f419f15dd115a9c550694754b4ec160912eb26e4d5be870732c73521c94cab18c26c443c71579e107170291e252ec6851cf7104e5b8b9cd257e2722f169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
f77ee5fed15d755e43d8f2864fc02c32

SHA1
c35ee83c6b99b800c5e3981571d3a1dbb087c080

SHA256
8462e91e88fb49baf8a8052b1ab89660f849e95be1392e046d4bc833596131b9

SHA512
f9445a09f1a251416aeb66d15b3a7d7595b10a9536a7a0325cc785adec889187565a51999c8f171c8a36bbbf9f28bb0c4be5b8f196bc49d330dfdbe5a1541f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59301e.TMP

Filesize
371B

MD5
4210171ead786883ec4216775bd097d2

SHA1
b0e4af09cf1cb92436ab829103b0c0f9ac30fc65

SHA256
1a7cf31ea3d1872b8d539404617b73da28632fbb651fdda95d68151d0753f2ae

SHA512
92e255f66fac46d6c64ae829e8af85dbe754d667445d42a3072a29bc9f63e2d4eb15ecdf65832fdba99491fba0726ccd56463502c37ee8614409c9bbbd6fb8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a0003213b55c8e84365cf07f0eb5a98

SHA1
66bbd6d329ea8a5a2d1dd603467240eb261bea5e

SHA256
14fef955518bc34bdcdaf64dcf2b9c5725101c1c2d60cf518a3e958a79f0d6b3

SHA512
813529497777a92ccca46ae12156263a4bd87dbda1c58dbb75cb8046c273ac36fba7b61cb3277d1af29ece910b40ff58a7062b277990b07fb3c87623f5976971

Download Submit