hxxps://signup[.]live[.]com/signup

Analysis

max time kernel
298s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://signup.live.com/signup

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
2352	msedge.exe
2352	msedge.exe
3796	identity_helper.exe
3796	identity_helper.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3460	2352	msedge.exe	82
PID 2352 wrote to memory of 3460	2352	msedge.exe	82
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4708	2352	msedge.exe	83
PID 2352 wrote to memory of 4260	2352	msedge.exe	84
PID 2352 wrote to memory of 4260	2352	msedge.exe	84
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85
PID 2352 wrote to memory of 3932	2352	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://signup.live.com/signup
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd446646f8,0x7ffd44664708,0x7ffd44664718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,14749205378333518891,6515227661681685214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
23ef802ce614455f72b18af929af8d7d

SHA1
00b1180270694da0a562b2a970b2a739552ede68

SHA256
d578dd3c28db2d196d741ebbb2202f480f0c0ffe9c734b677880ec17fd5c6ffe

SHA512
6ced9a4c3db2a617e2d5fc4ee8695f3f9d0c6a3080035ee0ea6404557da0b48893e0ba13a0ce7df8f684771180e4cd39e713fc8e928b9f94dd52dce96af3ab7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8c183b1cea1dd734b3ea34dba7073687

SHA1
e7f09ef3d1d38cee5af352cbc9007ae970d68f5e

SHA256
32442df792b7dc64409639770961fc0a43a10656372db171b9c1479aaedf0568

SHA512
f3a0dbe2f32961ba2603dad073e544a34d4d79183dce3ee4366be5f60e13db766058442cd77a3462a681320a91dae8f3c6691fab57789eecf8ba3134d561be83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
804B

MD5
0902e62c97dbeaed9c893dd863221886

SHA1
f96885c47c4f2c97f47f07dd786aa27d2e28377e

SHA256
84fdbba2df888beb23d5d887d32e0c533198c33d0868ddf006ac1a40962a87e4

SHA512
7c02a3435519b665142348644538cd126025b0f0d34ad42de48083b386870400ba3eac8cd45cf775632c97472929ab36ed85c81e4c7ea2a509b6a2dc1772d3cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
884B

MD5
d527bc67595301a8885492107629fd30

SHA1
1de5ea78b685be8c6efa4b303d8236d584ffbad1

SHA256
1e78420f4ea6e58e24c412758f0b9c8d142c31e0759f041504ea55197e47b7bd

SHA512
0eb8b762d0dd55e3ee01a035270aaa570aefea9b1e15c5303c19dded20a750801aba4f1f1ab56d436609eb820dce18a071a497cb9c08877fd356b0a7e87aec28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
bfcb8f03cc321b12021dd381e66bf116

SHA1
bcf3a35f4a5c205c0968f7928a7e7fee556d4fd2

SHA256
3b42a137111515e1aa64d3cf903886a2a5106813d8132ffa68f30d4fe2d7e984

SHA512
4eb71a2059cc8380d29c2655101267288b547cd81e0f7578892f85866e46f9134a002657e2c6078704269ae4a96aabcf40f40ec9d6ed75e054b1b5a54c200c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a78a915aa4ee946f5d40cc6755a01fed

SHA1
4ce1cda3cf3647a5d6c09dd614b4a41634405368

SHA256
98744f48065138a471bb72dbc1946ac9e722ad5b1be0339e195835685ebdc2c8

SHA512
20b7a2c8166828d7031b5c3cf4e705acc7af6969374849143c67ae54e4c167269ca738bf16c6f29296f78d034b857f2d8247c42488d73814177aa33a0d233ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
14d0ad69d16c7f032bc92671a14594d4

SHA1
88e42cc82f5741d0d469f35c983ba23f834a1068

SHA256
94bcc339d0837e008174f6430ea5287ae88bfa851677fe894ccb25f8f9ff54d5

SHA512
66c447a203060dfea7078f56e96ef0fde44e0c1fe29955efffc9e8e8cd03fe04c85e0a0b05d92fc1a987873f6b8414ec6bb20a79bfa5b504fefae3f5718ead91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ae2d905dec0cd057f26644cd23fcb72

SHA1
ec7c678edf10b8de606b2c59897c1e36b1e3926c

SHA256
6ebd6a2ed515bcad57332e5dce25179412f9f76ac5e5ced01382db09c3519a9c

SHA512
4a32acf93c5715e391753165a5118d9e8c1590c3d32863f60ca685f0cdea889e1ba624d426854b37ca1b9215ec8c6bad973092126311fd52b7acc4f999f61a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed2e52d0dfa8bdfcc42e7b3d3bfee7a2

SHA1
06d8d3a5ea54dc1d9bd59c581b9b875dedc833e1

SHA256
cd183effb9f009d1d2e9faed87d2f07fa1d3b43ca17c92536e02f305a613812d

SHA512
dcd9afb30ef8d3676a738d805083f58eb2b2b007e2dc289d4e9253e2c2aeb56e0e264dd1e62f0285562eda644f66a1e1ed1258fbb8356da274ad47b7cfe8cca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0fbda1b5911f5cc4fa1e48cf776380be

SHA1
9592b108b07556c4be3924fcd9b608ef491f4e15

SHA256
0fe462446a3e082f3752f326766a82194ed1cbb187637f89d59c050e83f1430a

SHA512
4d790d3df1bfce99ac68e4c6a088ed35c7ddd786466f2ae29e737c021ac642b7927811d085bc4e51d4a8dc1b208b237431b5a1fb19292831ee9a03321dc0e562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e95e462314373426d6247ec564e7dc1a

SHA1
e33467bb1e8fffb849f47a0f36501a7032c70974

SHA256
a62a74ee83349902a4a0a70b339db8affcf1dd48de03ae1ca9e51c27eb4327c6

SHA512
99a36960895500a9f6b8f447ba607370aa78d58069ed8eb4b652cdd825f9e805fbe93e293853207b627c13eaeb49fc7042a2d0d3751a1398fb33e74b42e323cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
08cb1fd2082503c56ece73640d4c63a0

SHA1
c811a2f06463dfa711c9d29c7c850f7256d1e003

SHA256
e5f212f2ee9652a3fa7b0241c12ca9d8d1ba551d4d051bd1cba093c834aa9fba

SHA512
88ba974f37f9f312bb6c40e40190128758a06b77ae3eee0f65685c12f5938749484e78f455a93b76a85a35ddadd999777707df6300621418bd91cc20273a2ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
9b65dc7ee81659bd0eaef3a9f3a904eb

SHA1
80cfc369ac0ea13f0c5876971f9e53038f7be0ef

SHA256
8ac8d85dd5d54b2ac136423f91a119b92a28fa7d3fd34090ffee420cd20677db

SHA512
c7ec94748b41fe54e440cd994b170b1472e7b75d008ab72b0d38c720f9821eca3caa379446f3a4753e83a2addb20173571dd984be7dec3682298c7b7f0691082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
025ed3311f80d6f459a10f7191f51ee5

SHA1
454be78dfa076d859acb0cbeaa35909d4c7b1feb

SHA256
650600dcae7236807dc5367fceaa2e6e5bc530c0b9c192e49d6d11d47d6aa8b9

SHA512
f7a317cd3a4c10586761b0c7e46be58f85927f1ff5bf9b668d7217e23cb6be34ac44d17316896d08f2d1d9bba3cc1f6614ffa97e75c1a9ec4b3c4036895667ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
d2342657c429e329e765fee765277941

SHA1
1e50574ede54561d7f7e145092b136d0fd4ee51b

SHA256
2ba4a8a8e7c0197e26c70525c66ea68a8df1864302087c08744c0fa5aae068d6

SHA512
f486c930f8c64a1cc639b0d0fbf92083c1f3480b4b899f29ba6dbde8a45c273ac3f2c288f94a0f6d2b22a75a0d94fb1583dcd3c584eb2e6440c92935ef12c3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
bbaa50d128f87c9927270095f5bd8394

SHA1
45d59dadb5f970cd08a1568f628505f611ec1ddf

SHA256
85b04fe82e0c782f24c8c8fe63d3bea25136e87b266ce12558fd67ee2f2edcc0

SHA512
931d210917eff7961cdb8e5b0352c4e2362f89aaeb3d6992485535a8d2177a7951c618246957422b53ac9f6518a6fa2b26ace96b09536eccf6281d0685ca0079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
e948984cc750fe4a125bf6623a04b1d2

SHA1
7190775f3de1d7b59c930bee1a426e7c2ea153ac

SHA256
ab22ba69093e9c0ffe1680120b006d9aa567e2bdd5169fbffccb74ce0a70ee2f

SHA512
aa5487a14294d10f481d00bfec410eff16954a5956d4acdeec1bb59a4f92ba7e15c449179d504b95ab0faee021c76f9c85d15535f4949a2940bc04296a60213c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5970d1.TMP

Filesize
539B

MD5
c23a2275cf2078b2b1d66a908094aa73

SHA1
11a1326217a7d742e1291629ec04a582ead0ed26

SHA256
00b587c8ea1a0e69551d7a9aa3275ea0edfb610f339b7b28f472be4e33ddde06

SHA512
430c6cc844af8c3271f77ac47064817791e54bd91066af539e84c69d46fb8cbd965d960c2088ac69c8baa6efd525acfd83b27e51e737a1e7ba953065e56aa9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b5449cc9a5f5f1f6159094ece290bd69

SHA1
e9d73ac58f5b8730431e19015b3f7c2ac5bec468

SHA256
a60ad5afa2abf7594762a9acb5c0fb9860a7bb852beed35d7fdd35761578b8b5

SHA512
aa6f520ff53e8baea37bbfe22798d3517f9d7c4f3620cf30bfaffbeb5f69b58ab52d52287e319d574edca768c3d69dfc5abafe4dbb37faca43ceb054f5d97690

Download Submit