hxxps://salvexgroup-my[.]sharepoint[.]com/[:]u[:]/g/personal/salbin_salvex_com/ESA5sdYuGDNDloDGrvLz-k8Bt0iy6yT_lsJpHIyRJM6_BQ?e=DiKLrs

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://salvexgroup-my.sharepoint.com/:u:/g/personal/salbin_salvex_com/ESA5sdYuGDNDloDGrvLz-k8Bt0iy6yT_lsJpHIyRJM6_BQ?e=DiKLrs

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
3284	msedge.exe
3284	msedge.exe
1636	identity_helper.exe
1636	identity_helper.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1476	3284	msedge.exe	83
PID 3284 wrote to memory of 1476	3284	msedge.exe	83
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 2672	3284	msedge.exe	84
PID 3284 wrote to memory of 4732	3284	msedge.exe	85
PID 3284 wrote to memory of 4732	3284	msedge.exe	85
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86
PID 3284 wrote to memory of 2416	3284	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://salvexgroup-my.sharepoint.com/:u:/g/personal/salbin_salvex_com/ESA5sdYuGDNDloDGrvLz-k8Bt0iy6yT_lsJpHIyRJM6_BQ?e=DiKLrs
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3d8746f8,0x7ffe3d874708,0x7ffe3d874718
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5161004654977848829,8591541118509352002,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1221c5a4-afd6-418e-8ce5-b1c3d693be02.tmp

Filesize
3KB

MD5
7f240445fef94d7fce402fcb3ffa3c92

SHA1
3e1cafafc690a027c4f96304ee1bc2b0fc9547e2

SHA256
cbb94b620e3fb5ae228a9a4d61b168a2d0fc6a7d7f77674a3da4567f7d1e3c33

SHA512
d29356c34d67a43671173a9cd23cc88961ba1e8af0c381abfbd6c651ba1e38eb365deb52be12ceb0075cef24a390382a6da8c0f6716b58ecb74a902afeb9a080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\205bfa80-8ca6-49c5-b6c7-438d183a9940.tmp

Filesize
3KB

MD5
513c797153bf76bcb92603ffb273714d

SHA1
5a9fb8510fad7a45e72635cb347a49fbbe1226c9

SHA256
68ad95778ca9e56665b875399224eee34687dd189634c9b61cb2092fb51b0f4c

SHA512
5d2346f404929694cbeaa98880a6bbc843b00d6003d73e55f4d73fd85f27d8596bd24a96f7110ba18dc9a237cb1beedec530ebdf4a355ae8128954cce3f000b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
62eea31406918a2190ba9d156df5cdcb

SHA1
769a44cba758dabd15b34101f4d63d528038c44b

SHA256
11986cb6329469e812b6905c3b2e49fffbded8d8bd57fe0f26c86039fc670fc3

SHA512
19360a8d822596aa32f0f231a0cb3db3df749b6a0df8ccf45be129d1a261f40ede403e485a3c4e27073a4cd90fd0b66655101f2416b699469cd9a9103b16a65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
894da35dd146920949bd21731e5b2777

SHA1
f0abde5c837513533504ae1b33b38de0fe2b67ab

SHA256
0fe90d320045fc72dee556c92fd8fa640cebebbf56f57519de082a99273ace5c

SHA512
d727913dda2a26c94543355b9c1079573ffdd763f5e47f63cd1fd687cb6dba14c8e4a476c9536de57cba9d9c67f3520790ac1644ca7f103d1ad1f28bed245b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f81bed6dbd2c98a3b0a0a9cdb342b7f0

SHA1
c8e05e852d1fda1ca61a7d15b59476d250f705fd

SHA256
97ac195a61f67990b6857f35448cb1877eca9d5a0169289f14cda2945d997bf1

SHA512
0bd539a282a4399062369097c079b3a3732dc6b2e842745d083a7e969b50c3d26f74de3174607c2af2c76d05d507be99a923ca546b9e864aa479ef78696e0169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b0e65a9889c21535c48bd37c7afc731

SHA1
4cebe386adb10de3499dfc55a96b240854e81c60

SHA256
fb71d0a9d5c6599a13ddaa70ec2a05098c7145d8f170c3c2a83be811a428161c

SHA512
d5fb293fafbe46a9599a02606ac6da6d7d3ad292b0c0b9534d7704b450b2b91f18ac2c34925018153569db1d9593798e3623df8104e5f91ddd617fbbf7e2a14d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66225d1c23f20d9169eb5d2bdf228dad

SHA1
d0c9a9489fda516684bdfeaf7f379f0c6f3d9b2a

SHA256
54a36f302a0dc1478f8f512111c2b26da8c00c296a0d5f0af5e782e2016e70b7

SHA512
9b200071a4919802ab4bcd58e322288a24fc0603f86ad3e9134bbc639b8fcec59193078e49b5d01532be60e308471b48c9b804d43e46cebcb2bb79a4e59801a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26e668d8202514245197c305c496397d

SHA1
6eee3a62cc67df1122b38f96459acd84f41177c8

SHA256
96f6b8a9a88f53f086fdf69003aab74d41ead56ef1ec36e9ef0a9ee4ecd29860

SHA512
7ab3d09705d858b06ed2476e71f13dc87f4b7081f4fa79df328d6747e62f5652b72c2cd194c373902f3fdddfa2e84c9df33cbf688f8f0477cbc296115bafac4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6638d9b1d7657e9bb1e6333e6e8f62ba

SHA1
ee1f7c03a77d9688965d0995c26b45a3fe7d8f28

SHA256
a3a58e115291d7e6d736c59e810e81f8fa0a3bb471973a38e18390127c51e8cc

SHA512
ba81dcc19ae081c4c884cb2fb3f7323ff6fdaa431f441897ca68103fd6dfca2cf59b672b8b41714f2a9b7bd85590f487015df0f285eb0de77cea892c25227d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
aa34a494e231886efc8a0e9c83570be9

SHA1
13dcbc45503d3eeaeb42a9f0f7f8a7bdec49d070

SHA256
6f85cdbc998417bdb01e18898a0fdc004f2e7af1838c846ddc451889f009c293

SHA512
d3df35711ad34c6c368173ea34de2b3e94d299bb79d9969746e01cb1f851e95ef276b189c8a64f63967bae5d60acdcd30cc36cf75fb9827ed50986dc256a15bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
75e338909c43b1a91e8cbef00fc0ab9f

SHA1
5100f8a2c45bfa31c8973320759e653cb7d30398

SHA256
28838989dfc6ffc36521e6a19feaabc9f9875c7767dbfb7286b95fe762a6c601

SHA512
a8eedbf5291fb6714e808f3ebfac92b7ac79060cf5c7e85ac76d7a62eefb297ca0dca348d0a0342cf2cc28370ff753fcf906434d966de464749ee0b8966d8c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0bd.TMP

Filesize
1KB

MD5
1483de39547a6db1800eb55b52baea3a

SHA1
2951d4141947868e85f6f5a8558ffb294832a139

SHA256
ca468a8785840784b35e4d4872aa7da3daa0b3242e89b88a234765cc2475ea1b

SHA512
b327f95fcc3ca041c94cd3c1c799eb1a297ef9f62bc30426f91ab124d8c2e58eb562299e70c0196fe93e0e14dddd76487eee92ae7eac107fb8c912fccb6605f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9d27267500f02aac808cec12f3424614

SHA1
a5edaea9a52145332e882900fc04129c6cd62575

SHA256
aa8285f2ab81698bf961d9d3606502e990c942b00d06cb449e9f57981dc69706

SHA512
6c3b74faeb2e9ca2ff01e679f9874f152efbf83b3426ad98dc37ee73fda6bce90793e70cb1c934234e49d9ba9ff3d9ba9eb9c4633ddbe682b73990e2b3d94d10

Download Submit