hxxps://urlscan[.]io/result/6bed2f43-fea0-43e0-9930-8be12a74665b/content/

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://urlscan.io/result/6bed2f43-fea0-43e0-9930-8be12a74665b/content/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
564	msedge.exe
564	msedge.exe
1904	msedge.exe
1904	msedge.exe
548	identity_helper.exe
548	identity_helper.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 3480	1904	msedge.exe	33
PID 1904 wrote to memory of 3480	1904	msedge.exe	33
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 992	1904	msedge.exe	88
PID 1904 wrote to memory of 564	1904	msedge.exe	87
PID 1904 wrote to memory of 564	1904	msedge.exe	87
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89
PID 1904 wrote to memory of 4568	1904	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://urlscan.io/result/6bed2f43-fea0-43e0-9930-8be12a74665b/content/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f45546f8,0x7ff9f4554708,0x7ff9f4554718
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17147729373765424401,3533463863403766215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60d6ed70-2a58-44bd-aa7b-51fb6385f01a.tmp

Filesize
371B

MD5
a80f709f6d6ad8f8169f17ebbca6fe67

SHA1
93f5b89ca866083782fcb4d7d700a9d7d33065e0

SHA256
eb6f1f53ea930370331f33bc95a601b89dd7d062c5066aa5f1f0bf65de701892

SHA512
eaf697e858716f5a9ffe2fedcc27fcf86365f31e1f782062233ce9831f827d0a456d1713323e9e2e3fce27fae269d7cb1edbfe2ef25ffca39743eeb4450a82c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
8a50fed0f6fda3b732c3556361881089

SHA1
e0477aa332a90377ace01c76f743f953c4378ada

SHA256
13b40735f7502950357eeba6559c357c0cb9a4ebb39b0debc7724af3aa8a8c32

SHA512
968422ec18619281a5c04ae5b3226a573a9bbacd04b5ed808a323499f62e36a337cde00859fc01feb1b0bd847268f203406130ff122c60d00ec699fa3f1fff69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
663B

MD5
63cb4835d06adc1993ec76bfb107fae1

SHA1
8238efce2c60fd45c89c06aa97c476a1e8edde3e

SHA256
32712494ff96be0b57629d4ea9ce5184893760cb6d66af84bb8fd18b15a585c7

SHA512
af231db39e0ae537031dc233dc5dc7ba5fd7f9a6152e886f3ef5f9a15784dbd0ac7530fbc6c8497edd90afe616797f8a51f3cccaae814089e2e7738b2f460978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8868316edd441b65c540c743edf5a31

SHA1
64150dad498de801ce895bae70ac9373643c03cb

SHA256
ada2c95d1e35ec049d095551259d92c2bc1021e3897173e7b12214ac168d7baa

SHA512
7cb068f60c10a699530df1b946d8ea82c22f48d03324eb50b5659abb3a097263dbe661c0fc09e528d0f51f07c9f2ec0efb7d87f30b8b34b4b80da2217cfdcdbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a97edb47207ddc328bd61533a93285e6

SHA1
47b265573b115112ce2df80c2771a97a3f0e8ff8

SHA256
1405227abbb8dab24ce16d1050dbf9df0241b3ffb2ceb0708af6cf471d2e2640

SHA512
741e79e622afd4af165aa5e719678cff93595da5f18a9f4ce6778fba30633857a4fc1909c844f8cece88170fdd434586616b14fe078df210f33dc456c3ff5b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0fb27313cdab7577b5494157c0e3c091

SHA1
90d9014eaf110982bc0112146e71a8aa62451c3d

SHA256
df1b432d9bbba93b589c1bbc793bd28d6ce9c1a9bfabbd28935f797404ead902

SHA512
9e2fd7e4daadcd5f66006d5d3b44845e7d2e4a5fccdba60dfe9615a92d4c13e71005c7124f6bc08cca045a11128aa4d7f5ef04333c8af1a4818163ed4478623e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d963cc838dfd06c4d2235b37d7a5df79

SHA1
c71b3359453f2a74dba193214b3d5352c3be97b2

SHA256
a339cace28e8779eaad53355a18d5c1dfa84a510953711c406073d7a41f7ea1e

SHA512
8a2ff4d2a970acd91e6a2b8dad24ccc5951632691cfe4e3baf5c7348d716e3c71ef1ac6427898b9b59be3e0fa4b02c8dad014501675ba816d72fa5fda33b66ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ec9817617a3b9232550204c1ef6ea0e9

SHA1
d07da85437747b5f92f622d3a30a2a99cd778337

SHA256
e62f85762d6f12511c19a8ecce2196dab555d17ff3a7f9fd70300f00bf8942d9

SHA512
cea0d2398ee2cbdb67bb742ab7607611b8a18e84ce4084a0c0b8f99383503ca619ceaa93c4e58eeb196e515739a0b1fb8fc30bbbd4efc6b5cd3fee3eb1583056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
66defe97f18720ed1d77db377d129d9e

SHA1
ed3c2519cebbd0287771c61be1a882d162a3a058

SHA256
adf5b1ee94615d2aedd48cb7b972f935635bc8c19d4cb8a1ace26d09315bdc35

SHA512
67e6f7772d87119372a5276002635d8a0cf93c20451f96de184bbf77167e9a9aa31a83ad8daa1bb70026b2da50d9508dd492b7c9e23f58033b769e8efe5e1af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d0909f86239b5f2eef6eb78e47a46905

SHA1
450c834b71c475c71151ac66376190ad8b63cf14

SHA256
61099a5199c63d6837341953cd8a5eeaaef1f8fa419b822f38b4a3f88f0ac92e

SHA512
642faff7b159528c966535bdf5411ae998a4f9fd54ce2ec4a0361cb14d6fed4f72cc712d7efe8bdb89408c7a9fdde402ed24f2c2d1f1ed493261d43d229f8f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e53.TMP

Filesize
371B

MD5
81d1d8fbb9e95007826f49d07009a2e9

SHA1
a2c7bfd6679700fff102ed68141d6ee19b37f7b8

SHA256
0fe0f1c202fa311f6be64109c2a45ec7d6167ae2672248829e425384f7052f77

SHA512
40c4a75597c640377d818684aa16ce41fb051cccbfd2c961853ca72fa8661ae786f1d39b3275ac4b9832369a00f5c562b8af5360d01c4c7c2c67d2dfddc090ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0a8aac58e35b4e72f630c195ceeaaa7f

SHA1
3851279277ce78df95ca0d9a9a24a351e2b44036

SHA256
6c476757d1ffa368138c4b92ad130c15e07ccb786337ac2181a27d3f51268133

SHA512
68008d3dabf70edf2a7c4640feeb363ced1d391705779274f5422b45a1e7cf192c178fcbd3a696f6ac259e67569bca1c56e4ba9c8fcabf73dae4732094c3260a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c65813d88bc109a2d6f418606a74a4e

SHA1
1a3aa3c61ce6b90d82839c1c98d4c717f392976c

SHA256
951182a9a46bce0a0310b2237b1436888ebe04a8d4454aabb23da13f5c0b5c67

SHA512
4e49141fe828a25a3c0605b0f10ebd3623e57a0764fa678b7294c539cdd277faac4f140bc5ad0fc9536405b1646d2d5fbf71f1b795cc8bbb4b12c5dfb6ac3dd0

Download Submit