hxxps://account[.]live[.]com/pw

Resubmissions

03-12-2024 11:02

241203-m5ff1asmdz 5

03-12-2024 11:00

241203-m4b27axphq 5

03-12-2024 10:58

241203-m27fbaslfy 5

03-12-2024 10:56

241203-m14m2axpck 5

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://account.live.com/pw

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
2532	msedge.exe
2532	msedge.exe
732	identity_helper.exe
732	identity_helper.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4932	2532	msedge.exe	86
PID 2532 wrote to memory of 4932	2532	msedge.exe	86
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 452	2532	msedge.exe	87
PID 2532 wrote to memory of 1188	2532	msedge.exe	88
PID 2532 wrote to memory of 1188	2532	msedge.exe	88
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89
PID 2532 wrote to memory of 5064	2532	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://account.live.com/pw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb77bc46f8,0x7ffb77bc4708,0x7ffb77bc4718
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6160686380415116349,11424726270765227292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5468 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
32KB

MD5
2e287eb418940084b921590c6e672c9e

SHA1
1fc75a9daa054ef88aaea181f3a9b4cba2b6b6e1

SHA256
6c2c58daae76131a00d1bfee20852f372cf594be7f4a8848acc42f8bf72c1bbd

SHA512
a77f69571b0f04f4a2354d9e18e41ef86f22274eaed20c02215b632bfef09c6543a83591e9db3f2b4036a9684bff666eb6a7b253ba18893500e9cd541ab752a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a6361798c6c6eafa845fc55b386ddc3a

SHA1
772b2c14fdf09a049af69cce5a4c05ced189937c

SHA256
95a94f505aea16109f902505a7f77994ec82e926f5e5f3c44f1a70bf57ce0183

SHA512
d231705f02661e8275c067ef7c1979bb92cebd2768548f669899b7ed054e5faf58fa227517d5e3b3768a4e4435fe20e96cc2deec49cdad3b7fe3b52bc77013eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
17c453dbe5e7c1a8c28ef82e9e978a66

SHA1
f8de8b266fe7859529d813d605f038bf672a5ea8

SHA256
4f03d8a068030af99a17d6496d96ff5451dd8a106d8d8690acafa060ccebee25

SHA512
327e0f9b2782cd20698f6a6a88778f51d5031bba92c0b1c7ac63e65dc0c39f913edb40e25df3d21d71096448fb12cb817b57904ff957517aca720a499939f3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
424B

MD5
53989b78ce60cfe015d074fa1d8d7b66

SHA1
5ac0a8b2af9b6e12fac90e58a52b533856c9426b

SHA256
bade9d784a084ce501f7cc0fc954d773bfd6f4a6fabdc6edc821e9e6879d77a3

SHA512
012936d23de4679521e07846062e79ac5db7196e2ef4cfe76b874a78927ffb2010e3566d389495b7c1077e62282dda2b6e95cc94fefca1dd475c8a05658ab754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d6a0f75edef968ebfa37ce6f466bc17

SHA1
135529773d8a887c0be92ecbb4796f35e2c69984

SHA256
3778be05f990cc8e317bf6d4e73f15d1c891cb285ffda31014bbbe79903ff793

SHA512
9d534e53f50e03a9bb414ec1e2ae015756dede9a6853a2fe7d5c59a2fbfb020d0e2c1018dc872265f37564ca2ae5d36ccb3942ae83f65c0585c3e01e0b46832e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4cebac8094395a1077a6eafb1782e63

SHA1
026c6fe3daafb3a48308783a812ced927757b1a6

SHA256
5dfdbdf34bf391482b0c5390cef4306d77d1a067ef50c310aeae40087297f953

SHA512
bb1694495cad0223ee7754cf42ff8410b3e73857ab328c1b445521bf5811e2570f2d8390ffdd675e7fe92f0ce9056389a1ce0b17128f2333a4e48bd9c7eaf9c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
a94abff4571758c716cef7b654c6fed8

SHA1
dcdbd253e270b3259fa17f724230c43f7d1f785e

SHA256
35c183460dfcb7fc72cd6b014d09c4f5af04320d28d008aa836eb2e209268cb7

SHA512
ccee7e3453290fd116edb4612433744be779c65a8060c9b8300d409155988e2bb1bb0cfc21bd0d509135fefb550afed2c5c060e234f542314380b1df2bdad23e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
5774f3de240d13a2ddbe736b1f65e094

SHA1
8bfe355472a05a808528c996c47e2dd5e39b79b5

SHA256
a34ed4916a3743f87339bd4859f30aea9348dade3e160b5b1d6a6407789d7035

SHA512
aa677874b36ca3c3aa74783a06d478b5af2a59e85ab5b1e866e794dc662dd0fbb58923c15d661b1e2c3cf2a9b1a582466bfcc1cf7af0e7fad3f99d4f0ae08adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
2b70efabf668dc37017b2c3cd9a9b3ff

SHA1
0a75a7be171812909b06f107cc60abe64aba817a

SHA256
4453290451cf88a319a2cae38416430aa83455e77faf179a2b53b2c92d79361f

SHA512
63d684dbfba2b96a2fb815173ad376c7e5fb7b4028da05cefdbebf063d7eedf494377e8923847731a6559a8b331619144fd9a2abd177808b335ac416270b1eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
378c2dbe7a42f4b0681aee585799fbe1

SHA1
171b1d7c8d2ea7d3ecba086d9188d278ded21aa8

SHA256
ed653ae7055bfe72132f52af657b5cd676be5c2b1073707e21acc0d42d547030

SHA512
2e151bbb5d6c7fb9ee68e6511eb8b899d0f7fb1b58cd9e81890e09ba0fbb61eb3148e2389fd22f78ba0c30efcb4b852b083d13bd9ec709fc2fd40f7467a098e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b7f6.TMP

Filesize
369B

MD5
923cf4588d9416ae4259e26a7989e142

SHA1
7d4ffece8ad7a146f5ace79271a65f814aa7039e

SHA256
4bade743b84562b4d7d7cb3142866bcb99811a444691ba89e2d76bc0d79e11f0

SHA512
1e5d04d01e552fbbc5962b7657bacbcd73b10c09d5dbb07cc3124ff6ddd14490de8190a766cce544e00347a52937cb636f820d302a156e97db510978f548bf6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d018510ede5a67f3c77e6e3c05f8428

SHA1
80e2e3713247a5a0add71d1f3503a8d00826000a

SHA256
b07a67a80ba14a624b55d67d3a3a7d53493b9fc2231bc3585ecb9ed2d2822d9e

SHA512
19e6c215e36d84a52fb7e85f33b2f2e4ff31bb6e5686d6f9aad434640f5adf0e5c452d54be6d62592dec146951f34e57180095443f12ea99a9c4f6718111b133

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit