hxxps://aka[.]ms/LearnAboutSenderIdentification

Resubmissions

27/07/2023, 01:31

230727-bxq2zsgh49 1

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2023, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://aka.ms/LearnAboutSenderIdentification

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
1868	msedge.exe
1868	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3292	1868	msedge.exe	84
PID 1868 wrote to memory of 3292	1868	msedge.exe	84
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 1524	1868	msedge.exe	85
PID 1868 wrote to memory of 3856	1868	msedge.exe	86
PID 1868 wrote to memory of 3856	1868	msedge.exe	86
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87
PID 1868 wrote to memory of 1240	1868	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/LearnAboutSenderIdentification
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd97b246f8,0x7ffd97b24708,0x7ffd97b24718
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10344023627767863021,7101440155104291659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
f55b82bf03c11b0438a37de517a3472c

SHA1
79a06fa818cabf87175490d9ef14553bbfbd3fbc

SHA256
e5a5ff0b64fd6ab7004fff1e45c6be5882c6ffb1ef670a1691c91688da453841

SHA512
e19a136b9c63be770e30d29e3f358765017c4b092e23b41e706424c463b6055dfaf768aaabbb1844a7b10d8cda460e3cfac231bc9996a599e289a912a69998e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
243a921a3c3c45e620d65b8fc585b304

SHA1
8470964ff359f0abd4e9431bc6e6e13d467b4477

SHA256
c690fa06e9c6e5cdf97bfa3a41ebeab226e8a4d30af0d4d75f06a2871ce26f77

SHA512
e70b69f61751671203288adc95f796ae6ff586d546082d372cafe5b41510f3210db9a1da59a7aae793a64543ad6996750069d20ad013efbae5b4153154a421ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1647525bb74081f030d4673e6dc47321

SHA1
b38fbcf3c6db1efacd8b6d8686694e6eacb1e6ce

SHA256
42758778313cb3c7f5af9da556e6247e07bbaab201f849271672f3721f5f6b03

SHA512
21792ee3eb38195a753c03d0960a7f03ce2b9525208a5b505697ddf4d49a25869bc113cd4e4bdc795434a5f71a9680026b1a6f72f29647280df66b20bbb15f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
385604264a77ac7d65327be00bba3921

SHA1
f8bccd06c6350819c08d76cfc4b749c2c275b2b2

SHA256
6257066450752b4c9f363efd59172640fade63ad7307de847aee4f52097b09c9

SHA512
05d02a94611ed233ddebd79b8f8cf9d01a0174cd503b1af81b7c3ed5b42cb4e69d91e4cc1a4ffc0ad26e6e2757c7966ae5b166eb607af20091b4097642412164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2e99d169ff74d0356e9890ef05c2f4f

SHA1
eefc8a6dac4510e4ce0daebd2acd03b1909ea4a3

SHA256
9187cb0929c292b77c9d3f597e6b2fce1204463b88c1c8d546cb0a52e5d62576

SHA512
745d9c6b400e9d803887f04a66c9f5dd80c208ecb7796bb1940f3e7e5e77da55bc0c77b66bf054a631cef4fcdd29d1829ccfc8b33f937446f592f65cc69a91e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66bbe3bc641a0c219ae836a854389b85

SHA1
56cb853e02c720c0928c725aea5474c92f65a611

SHA256
7c12ebccd42ce017322a2bccb6757514a24dca9231ad4d0b4c06b4dd66e23683

SHA512
45179810cc76e14d4813b6f8d8bd823508c4a5c6de65b4a482aee8932914ca17d4e3924b48f4cd9c7841cbd0882ec1c8d2ad74afe6654bb670e8ce1b495ac86c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4f1b3728f3fa84a2b206ab1bd3ada2c

SHA1
2fb1de233cc5b81b172fba74a1d4f72aaa5fa8b2

SHA256
ea3437b5185a4957cdfe01d239fbca40cb6503cfeadb7f3b0792c8972d67e242

SHA512
8651f0c87c251c28a71cf54a8a6643f3de8a2bbec236327db95ab04a95db3032d4c0df8406b19ca6177871811c7833c743c6dfdc0eb89d3a227412b59edffbcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
31e3f626420ec2bc09f9f9c9254c8a5a

SHA1
cfb8273d87c94794c347bc744f0ebc4dc1dc3676

SHA256
1f699b0a4294a645e6b68ee40de34396acc99809130f771b9e2edb6457dd5ff5

SHA512
39324cbc878fbfdaa9949824f6e4c73a7ace480c34372075ae44e7bb00f691607cc3228b22a42875306d5d93cebb05f7a81079fbd9c322f000ad919fec24ae13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8beb5c8714c3a51777259d448bc65278

SHA1
fb50b7b8214eeb5149198dfa738e4c24b0d79cae

SHA256
fab8b7ed72472bece6ea7d65562ebe2d0c46daa591de2fd4222e2e14ff3825d3

SHA512
e2a517c8dc7a7b08fe2c71aff87d2b8f7fdc49eaf1d4846b8e650c9566cbc131ce3c936a43aa9e5d49d8e81d2d3473d4e494f67c2c50563dd52414da39e120ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57de5a.TMP

Filesize
1KB

MD5
0cb933bbd378d9521c0f69fa92743f6c

SHA1
dd4e0b18c064ed4c228070c1bc220d171d8ca294

SHA256
83c84df5836604fe21f0fb7b3a406bdfaef78564f6aed7289b5b3a0c1049451a

SHA512
dfafbca86d5758d881effe3a8a9266184445c416717d7c2176c1e016905f157655a8a142f5a32c4891f0d5b26bb45a8928eb91babdc29dee40c51595ad94d380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
3932dee959ce69a81edc4a8c2eddbd36

SHA1
daf163d929209a72f3d2629027f89fe4045554d9

SHA256
10e51993107307349633fdf9e59ac31620701db0c10c8ec32650f51300e93c01

SHA512
9b3127c3614a1fc56664f702fe143d74cdb5976219131edc35b51be2e242541c20d076169d0ef3f690a051e19079c6c5c3d33b5789cd8ed29297c64a0fa5aff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ab62f4e3568a61be51d47784eb335a08

SHA1
1a881aba5c8aa18bce761e46928c318e665256dd

SHA256
c29a3470898f6438d9822a47b9ac3b25e602f83a11f7a66fdfb7575105f54468

SHA512
3f594a119b8c13b4d52366ce1f057c41d9503cea56623218c318b17e1f3a8404c5723a4f4366b7fa1b7206618cec7df89b2fe26c36025d00acf0d2a7290e0a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f066470ef1f1870f145c443936d75f59

SHA1
c29da0e7ecb5ed143ac024513e7ae3724cb17cb9

SHA256
969764d0e3041dceabbacd0bcc665de174b307ba66ef6ad0e14b44e489e8f95a

SHA512
a6c1fe40b87e9fd2b31e658e348b23abefbdd0bb3c91eec25e2f7612cb8665b9d6f42240f42a5696bc85714e56ceb6592ebfc4ebe56f39434666de93140d3d13

Download Submit