hxxps://www[.]processchecker[.]com/file/rtHlpDk[.]exe[.]html

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2023 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.processchecker.com/file/rtHlpDk.exe.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
912	msedge.exe
912	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3524	912	msedge.exe	27
PID 912 wrote to memory of 3524	912	msedge.exe	27
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 720	912	msedge.exe	89
PID 912 wrote to memory of 3724	912	msedge.exe	88
PID 912 wrote to memory of 3724	912	msedge.exe	88
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90
PID 912 wrote to memory of 4600	912	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.processchecker.com/file/rtHlpDk.exe.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe034246f8,0x7ffe03424708,0x7ffe03424718
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4632476446144623154,12736883327602125216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
2d461643891977e248fe670eacb76946

SHA1
6024a1408232bb08275095c8952daab1d0e8a184

SHA256
8fcb771e7032f52589becab02ea1384ff54b43aa2dd276c87bc631f1767016a1

SHA512
0649037f77ae8ad5c564676d8e0f7be00c96c5aa11ff3b90457fa007b3b1e0c49503a4c74efacffd824e089c92d0e5fa6e3d7f245130e8bda9d4179b2653b419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
8a1dd575d926d81aae2cc3921e14cb96

SHA1
db2565b4f1ffb58c77d5ab80c6fd03a6c69316d7

SHA256
aa196f55be0f87442b72584764386be974fe94dc64c0136cffda9299660d145b

SHA512
40acfe94095a53e88e4568748acc7445ac8a1ebeced632f0f65ee4c52683e69d2bebd2d32610be0e27c6740752195f2e024aa2eccf19f61c6643ef93b2ad404c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
08298afe3f336b90fab5c252204c86eb

SHA1
53ec193989cf20755c00cc237acf41325e4ef43c

SHA256
c73b2e3aa245babfbbed15c909e67b622d8d0d59fb05df1f0f89c4d7ed4a5d01

SHA512
cdd6fe6363e122af74e4d6ec43f62db52116d74f5f152098ca34463395c360ccad8fc60174ccf851e9ea5f857ffdfecf3f78928a04a0abecd04ad1dabfb2aa86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
aaa09e90bec8ddb89a83a65bcb5e49df

SHA1
3b1580f286b5e7ee13a706ae93b28e556a027296

SHA256
df3204ded75ca43a38c7e3549c816c1a8fabc80b427cbf2bbc2d8d65d592a69e

SHA512
238bfafe97b8c047dbe67e257f12de34befae5b0d3e107abfc7acda1176a2576065a408e546bc70ec5bc663bcd7b3e0d1ef71ece33266d67c68b919de5d90f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae235af553a41a2dee2bee55cf4d91a2

SHA1
8fc5699f2497db2f17822a7194f4a8a508a07e52

SHA256
dd0d0eae2d6c23d0e2c80c8f68937576ae0d4065ac8367317e2fe7c0fe64a177

SHA512
44c46b549919231f909c9b585b3373562936730a662d7141b41a20ed6c301598ad9d6b6cc4a5f263b54c0e1b8b733a5ae686a5b208e495c62c9cd41b6920a97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7e1516ffb2c79a77841a35d127d30ab7

SHA1
ec86881e420ab349b9084e44caee24f75ca00781

SHA256
12cea0ffab895fe50d6b7e04337149347cf9e1ec00c14405cd6f56eef28ccf4c

SHA512
59505eedd78ee445ecf359dd6283221f5aebc3547df0afef3f5ec8c48edb67562557c1082853db19fad2d3960d7552ae0f3d6f4f91560947ad335276ea29b36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14e8b1d3c0fe7696e733c970d830d036

SHA1
8a3de9ae8ea27ed37a48254c002d3275ed45a81a

SHA256
fb0ac7d12e3ce936c5cfd221428529ef2f0586de6b854213c2298b95a1ae6b20

SHA512
9f1aea37828a26a70ebdf1157ac4b00e47dc869ef31a9d647a36e67583572347a1d05079c448e00036299669bfd7ead06516ab48ad0cccc482f388c4694108cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
a74c594057c5073454d46e7075979deb

SHA1
d79d49cf17c6b5fc0cf6c38b5b477f310153cd89

SHA256
ffd093aa22f8aa6774741bdf813909e63a2d3b7faa4e706877b255d795cc52ee

SHA512
700bd7d926d64231e8341745c37132acda84fe0d8d699f1af4e27a0799663733862e07106375436ec6f24a799343c163a5ec6ac2c302a2311e135cb61fc0adb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e91.TMP

Filesize
705B

MD5
b45d81736488c079009a6eee5e69653a

SHA1
127d71f9a890cc6dc00ebe3861bd1f2283c6c109

SHA256
ea495084121a7d02514e75ad751b837112fbca72c4ffaa11c336887c6fbb15da

SHA512
36fcf31f713a9103b3651a81d455118ae50328e535f5c3784b2320a9f68d1a15dc64f18ed7b2cf361ef8edc5efa96690b0668e7f5b31c99b570771cdbabdf143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000007

Filesize
17KB

MD5
aab2532f8363e63359dbf0c31981f57f

SHA1
a21523eb85636a0455977ffe525260a1a8568043

SHA256
a6abef5f074c67b1f9fbee679151a4c705b71f054c98f720dfabdc65786d5d13

SHA512
7b3c4ce6574b36bf0d4e05bba1063798b525744fdb37b28ad6fc78456ef7d704677795ae4dd0d0eda0954d15b3776395fa931abf82dd4b64583c360dd9916f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5daa987e982e54469eedcab34deac924

SHA1
0047cc2709ebe8eea6dcae346a49963738329a69

SHA256
2ef5fb93b9e9caa10b11a8c283095eca53ff430fdd90fed65a59d72ee53483f6

SHA512
075f948c536f7e1716cb4f55ca795a9d267c5ecea4ec689c2edeff9ca60bb2990c8820aab792513535a82b6774006b7e091ef47ba5cf513d6ffebc7ac8f1b487

Download Submit