hxxp://www[.]johncpaull[.]com

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2023 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.johncpaull.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2720	msedge.exe
2720	msedge.exe
844	identity_helper.exe
844	identity_helper.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 4432	2720	msedge.exe	81
PID 2720 wrote to memory of 4432	2720	msedge.exe	81
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2268	2720	msedge.exe	83
PID 2720 wrote to memory of 2984	2720	msedge.exe	85
PID 2720 wrote to memory of 2984	2720	msedge.exe	85
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84
PID 2720 wrote to memory of 2968	2720	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.johncpaull.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f1eb46f8,0x7ff9f1eb4708,0x7ff9f1eb4718
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,14502146494665111199,4434101283830845197,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
8f56ec3da27196609ef1cf2f25edd73f

SHA1
985d9b033add01f593f73510b4d884440b247360

SHA256
8e3503dd40c8f7a4bab6ef8038eee1e1a370157f03aedf87b0cc3b115b73e738

SHA512
7ec93807419c1ea2a32a29c14d1610d95c3351a747f8a7a790829702ff3104f47827612ee6a6eb79d93f5c996694e94ec59b7de04baad71836024f130f3d928c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
782909af5cea6bb1416d0a9f2e5ecdc7

SHA1
68e61ce4ff10dcd0223d06ea20b54667483d1b93

SHA256
25fd2d5a98d92043ef6d7db6ea83cb306ee5c5f82930830c4616ce7adfc29283

SHA512
9d88d5d709aca421aa069669557691395fbd2d188712612877bb4b853a48a557841d0c49092537dc6b1254ec4ba2f880831750bac8a9d76e7d13a4d918493c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2749904c41130cfc5db8155618291a68

SHA1
a6189ebd651509ae45ca02df56f3fd3bd868868e

SHA256
573cf0073f0a9c92b2a2d1acf49ae437fe3bfe45277402439d69ad385203b38e

SHA512
402e38c288b82ff2d8eeef4de36edb2e29fa1899d7f1725c978656a5cf4eb67cd37abf031654da1f2ef3a3169e8b6a7506f2941c703bbb70c4bedd8604a32aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a464feec45ac3e24784ab1203c865bc

SHA1
b2e79c05a6684ff73b6c39161ea4e67bf0a75c22

SHA256
bb997c01d1fec5f849f5bd065072d137afd9f0bd21b1965300b0132e33484e16

SHA512
85a81fb313cba7ebd4c3e244166ddf5828c148193e69afa6028164a430312e753dff22f6a402904d241611b85ff13300716862e73d39da344df345611b330ed8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9eb129e43223c8c72c3c8a3a0e5fa82b

SHA1
10422def2f40945f290c464b1421987f8994777d

SHA256
f7638756c309588964114e93706130e3945e7380f22a256b8424cb0b9118bb2a

SHA512
c410ca91e0adfebde2d4b20881a99c74278d694fdf668ee7ebdbaacf591b4b642b31a69dedb50825f67574545ee24bbeb5f459756e50c86149af966ce1d0e0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
201B

MD5
72e2502f9a41d5e9226c5c120cbf04f6

SHA1
1d9e0247111ddeb99925fb7c4e40fc5e53f1cbf6

SHA256
cfa0b1513edc7e8de680514e56c31cb4f9ed14364f2630bd709cb5b369a93bbb

SHA512
2ad30bf0eea98632621e56467ddb6c1ca4372f1fbc7376fa8b68ea8353d4a9c902d606913dfc66fe27d54d1e6ca473f9bc379c56575cdac5dce273068fd316b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5985b1.TMP

Filesize
201B

MD5
bebe6e1c1d9eded7877256df871e8338

SHA1
7079bafee2ab856d7d4125c18d0c42d472745847

SHA256
e139e88f6e2bb95476a9ed20b85e30df5dcee5acb440dd9557e88508a2d179f1

SHA512
17b28eb8f18ea66a667fdc183621a7f9fe3244b298308ceda90de04eb7fc103dccfc182b0e5ab355a31415a38f7487ef668eb4d8e7c56d344b8b28ae6b86c587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
effcc0b16c0251bd7c0d956895a573cd

SHA1
258b7204e109d8fb7e073484374c05e258d0cdaa

SHA256
d8f1d36c55a9e83aa5271d402c95d4379d033a5f24b75bb6a5c2416824c4a992

SHA512
490b3857c3ee276745ac3f7370ead3b107dc26eae8dfda9dd839d4c06f11dc3adb3f2db61de25af63fff7566ac92ef776aecadaff9e1717eb08bc7e552425e88

Download Submit