hxxps://t[.]co/bjKtzwN3yO

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2023, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/bjKtzwN3yO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
4788	msedge.exe
4788	msedge.exe
4336	identity_helper.exe
4336	identity_helper.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2812	4788	msedge.exe	83
PID 4788 wrote to memory of 2812	4788	msedge.exe	83
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 4872	4788	msedge.exe	86
PID 4788 wrote to memory of 2756	4788	msedge.exe	85
PID 4788 wrote to memory of 2756	4788	msedge.exe	85
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87
PID 4788 wrote to memory of 4808	4788	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/bjKtzwN3yO
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xd8,0x104,0xdc,0x108,0x7ff80d3646f8,0x7ff80d364708,0x7ff80d364718
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16124429665404831519,3937225577528296344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
f9edc454a052fb750e3b22b6fad7548c

SHA1
435a63986a89142edc62aaf54b8831a4f41fdad3

SHA256
b989e058982f0491583a24795a7e8348a965b88d6b6d777ee06ae24969259dc8

SHA512
239818001817f785a86e000d053021926156ccecff97ec0387b9122af1e44e4540d1f0f569d3eb7a69878c554c5636daf3f15ca82500a008fd4986092b61fc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
53c32e67efcc06e13a2367447bc2236b

SHA1
441a5c1ca156e619a4bb5f7f595bf9a9dbc432fc

SHA256
2393b0ea6b2dd09eb0a73b1c21213f5a293c3f828d3a7e393c6e99c82a0b3ea5

SHA512
a1f539dbfb3b248f7d1dc7dfd0f8ec8c7314f3d608422cf1fcef0861514f8d9fab204bc27f00b6f00971bbab04b9e6f41507ea98334ace190eb0abb5bdb98be7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
96e2a343cbecbe56a2f405bef5c07837

SHA1
117ab9c4966101f2ce959a66d3b3e08b15dea0c1

SHA256
011302fadaced4a5cc4847f362142f8cc2513517dd8b50e4b623f9844d13b3a4

SHA512
9dc18238b51f7bfaf91fe68e275887b17b53c12deff9f7fa02692ff3adfd2bce543e885354a2f9274c6e15414117f22dad1a867760b6d7512c21147ae0e556d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ccf66e64416869a6269762e024ebe419

SHA1
5cbd3cdb736665c40180754621375868016de799

SHA256
0d64f688a756a2963e46023f2be24e8d055fe5c6eba376cfa3e9e77d11f673e1

SHA512
a028b85d4e890caac9ee1ce4c2feb8b0d22b750c546dd5816ff594659f4c42285a9a1d75cc519237fe8fc6b6e602625b0d6267bc5a410a2ad1099eb5af127a28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9b2715d2cdc0d09aade511b2c4ffc0c

SHA1
45d6e95e75880bc58bcd3eb00f94624407770038

SHA256
3a0d7ca46050af1f086765f297ddad3b27e87cff867804f9c6ffaa5ece6735f5

SHA512
60e8a9b101ef0ec7d55f85f2e9fd2751aeb899b941b121f8bb92794bbe1408cd24eedaf3cacc4489b50c99a278e8a16cdc34c1d3b901b555154181689989628a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3db66c5bfc143a99b0d74edf2d9511f

SHA1
e273a70ae27e567f55e21e4eaa039a7c2a440dc4

SHA256
525aae5b4294ff1fb704d0d70fc68dc3f5056ffafbd7846995ca0e7aaee431a1

SHA512
41e9965b711e188cb16884e10c86e2d611892a7a5cdee7a5f4ac2e0e77a6e3d0bd6fea7a8d519951446a59f69da96cd03913b155de0d425762dc5c214c0cdd18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cc68767085136933b472718ec4c9ff45

SHA1
04a512e08cf122dc4c15954e07ddf5ccbfa82844

SHA256
a964b117eb1aa4b15c54654792d7daf8eaf7f2bdfce8faf0504b496e12de22cc

SHA512
35c430a3b9869373c18834eaa77e5d29fffe0bfb9329719104732b78077b723a2583941a2f7fb43e432219bd9b44bc9e8c4c37a97cf35fe58a58eba9dbb4de48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
62b99146be54b93f395b197e4f0b9760

SHA1
b8dd07572bcc3a9d48e42fbd6c044a04eb46f494

SHA256
cb2a8601428ddb4630618bc7afc5997b20dbb0cc654bd94d0aaa5b697abc2742

SHA512
95cbf0933f5d83098ccd7219bdad37a4dc475be4de716a341848d989808486b3ba6f09356e217bbbf5158384153e089d1b8d0b42281aa9432ecfed2113a4d44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f136.TMP

Filesize
1KB

MD5
a55cd8b106a14dd6925a544e63647caf

SHA1
123e5f1d0d2ee3737a64c751ace70bb21b6dcb19

SHA256
59941e8c8e69db175ce77b51c528ac2fef7494d69be85406e41ef79446df1c2e

SHA512
f908dd7df634ca4f4d1c2d8bdc77beb01009d5bdc996b3d9599c9b13396af3f4e80d9040fc7cd25bf8f1e711c6974bb7317554fbde7ba174187ad3d52286ba07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
11958c9d3cdd923f48a2d5389f5fc3da

SHA1
7dc3951a295efa104b1be37cabdc91615ab97e72

SHA256
ede1de13fa8e236a37f51e29acfd3413ea67b7f5c68346ccf2c6507497ff62dc

SHA512
ffe6b58ece51e8f9a396cddf82e3787fb19b3c4ada82b0b817455ed36631c86cd535454c8bfecab15be3b843353c814c33e3b74d15046667a1196c7e0bb80410

Download Submit