hxxps://gdlt-zcmp[.]maillist-manage[.]eu/ua/optout?od=3z80e304507a89e56b0a2ad43f15fac107&rd=11fb54c0beb4f58f&sd=11fb54c0beb4a1e7&n=11699e4c1425554

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://gdlt-zcmp.maillist-manage.eu/ua/optout?od=3z80e304507a89e56b0a2ad43f15fac107&rd=11fb54c0beb4f58f&sd=11fb54c0beb4a1e7&n=11699e4c1425554

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
2272	msedge.exe
2272	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 4980	2272	msedge.exe	86
PID 2272 wrote to memory of 4980	2272	msedge.exe	86
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 3240	2272	msedge.exe	87
PID 2272 wrote to memory of 4684	2272	msedge.exe	88
PID 2272 wrote to memory of 4684	2272	msedge.exe	88
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89
PID 2272 wrote to memory of 4256	2272	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gdlt-zcmp.maillist-manage.eu/ua/optout?od=3z80e304507a89e56b0a2ad43f15fac107&rd=11fb54c0beb4f58f&sd=11fb54c0beb4a1e7&n=11699e4c1425554
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b6446f8,0x7ffc0b644708,0x7ffc0b644718
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17238861405848770849,3967248744081750407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bde89b3-350d-4fc7-8267-3cb14ef9cff0.tmp

Filesize
10KB

MD5
296cdb4c91e8797ea475520a9230a18e

SHA1
a00bf4b9cfa7bdd4077515128933afc3515c0bef

SHA256
cc1591a2b5f1a99ed6f0614521802f46c37e2607d55baa8d63c4161b845cfcb5

SHA512
9dd68835edb7346651d0825ca88294f7f1b12bd18473d41a6ad738856e70b54b12f0083bc3e3748d1924a39d4f5d1ababdc8771a695bc67faa9009c7571cf2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b33002761deda5f6342ec2fe5b5f4756

SHA1
7fc54dc8d0f6aadf7c5dba0d5fc50ebab1ecef43

SHA256
7bbe4e72e2373d92be8a342a450fd2bdcbafc7f741032123a0bfa28882bf87c2

SHA512
0204822d5779d7be6d4778bc5402c8fee5c55d6aed2e2201784899b2cbee08eaa29623bae82f1e3e99741bc74a62b81d5530204a827b63453c2276375b0afc85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
220457839f13d26275a817391b4416c6

SHA1
e6094a7d6076dbc56800b2cbd5e363d08b5b733d

SHA256
2abc0b790c4a881b9a10b50bbfd5553118712369f826afc22b5ead606879fe09

SHA512
538d3e1736007f37f642b043a72702ee75e7faf1ff981ebbf0fe9840d216835bb6a8a673a12daee5dfdb78e7551fc18653807f0ce5c70a03642933068374b0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
194B

MD5
95f74c3f1d9d1f7298180dd59bfed46f

SHA1
6dd410816cd243c060406caff7bef5460d64209d

SHA256
ebe88f1c0d76ba66ba671b6cc34b30bf26e1408e46f037e47bc743fb51856cc5

SHA512
db679933dd9bb73c5ee51c37eb605b26d512a1e4d31df478d33592f330c9d246a53303f938cee9b6d960be711a49611a7e185d64362b1e689e6021acf87f6a3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67b0c5a15dd922bbc2cd12eae60df44c

SHA1
58665b828a79cdd0cbb9f0d33c317f818729bd8d

SHA256
f141ab3a919b88d1f4b493a8002ffd6cd264e1249f2d4d180f73c845da978013

SHA512
0bf2124910de878e86224db4be7640c00140823a0495db1d3470a02aca04cccf5b8018fcbc2f7bd9e34862ddbb9c69220f0f6910cf95fc928a413821e89c58cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4b51968208e940b9edbca623235e8a37

SHA1
cccf4ac5d1f5265ca718df8963761928006e2cdb

SHA256
f8aacd33acb4c8b30d337dbb8d6de57a722e6362983dfc563837fd1169cfe113

SHA512
e5162af15a92e679a42e2e010ae932f8e2e697c4146e80d0d9ece7349079ca6e0b09931905aeb1eafc14bd8ceae3fd57fe58f14b3edbfaf4f2abb0ead19b4429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ebf474171a16eeda662db80951b7cdc0

SHA1
9f3f5a9358b2391f82587f2846ae009deead977d

SHA256
de413f228104c4c18c24ae107df22a4dd86f041d1286fc0990814dd45560f317

SHA512
866737900bfeefc8ed9201fb2a95e381816320c2d588fa739611baf9d20a53f0199b7543e549912f868050f7219500d31b5c8956f32bee27ba963318ec31fd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
63b88a91399d49b22f843796ee18b927

SHA1
8557de38a03d40cb383fdcdb8196865da1a3a758

SHA256
569cb2ecd6083e2ff7b7678fc7ad4bb8cd36ba4701408e2b8fe5564c6a01e572

SHA512
39c9ab8773d76480315c61a2b07c376b35908e9bd1b1f6ab7246e37ec81e9d07780dcfa014290e6315a60f96c0b94b1dc555bebe08652ba42028e76cce7119d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5847c2.TMP

Filesize
540B

MD5
dcbe4dca743c8e6d1ab4d8878c6fe150

SHA1
2a0bb1900dbff5aa1a72353894fead936ff6b18c

SHA256
59b76efe69e9f440d38044f71e077d80f16a243d50387d4be53a681791242e51

SHA512
4be0420fe0fd0c0118df24a5af4a51b9ad9df24a6e31b41024d3fb2db4408e644b40f82d64d0c7f9a87020811d9626771a63c7776529a859c693ad4329023252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
66426bfb7d4bc388626f46712aa02829

SHA1
665f2c3b37399631f49f6e7ad9b8fb710af392d4

SHA256
f8848d8ec50cb8e930456cf82d2aa705d8a5d2c8b955fe35c87fadf9550a63bf

SHA512
3b57fa645f82f6d7922ed7a1b0ca598fd15bd5a3a3e69a8ddaa8e76896457146394d7f623a4a44406bbaff550f6ba01221906347cde3148bedf4034a28724c33

Download Submit