hxxps://docplayer[.]nl/95758104-Patientmutatie-bericht[.]html

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://docplayer.nl/95758104-Patientmutatie-bericht.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
2204	msedge.exe
2204	msedge.exe
1724	identity_helper.exe
1724	identity_helper.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4580	2204	msedge.exe	85
PID 2204 wrote to memory of 4580	2204	msedge.exe	85
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 644	2204	msedge.exe	88
PID 2204 wrote to memory of 1128	2204	msedge.exe	87
PID 2204 wrote to memory of 1128	2204	msedge.exe	87
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89
PID 2204 wrote to memory of 3240	2204	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docplayer.nl/95758104-Patientmutatie-bericht.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd00d046f8,0x7ffd00d04708,0x7ffd00d04718
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17194399350247016892,14518790413013218056,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
552KB

MD5
c9de0240b5f78fa78fc2b4ea24578b59

SHA1
5389aaf330089882a68e65e7f596016d44e6130e

SHA256
d619cd315a2cd949b6b0d16c5d2541aff0c943d18d305e7035b8a71057f5b4ba

SHA512
681a6718c41c4f026c7418c5c164d4985f4554a7eab3c85781c007d7985425b79326c0ece6f0251b592e6fb8147e9c6698a17977802f30ab131bbc8e0a886519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
3f413bd489f7e800eb9c0b2bca06d22f

SHA1
7cee81afe68d17c4addb8e8b4270ef8f21e4f9b9

SHA256
225dd1299dc75bffa27ee5958b1c6864e69e1d222169591a4c16a5bb6843be0a

SHA512
0662c5da26bb8e35fe2dec1904120598b0ae3ab3a530b512a44a90d6c56f75b4607a4ad8dff9563e8f8dd9a8f4e9d8863b21b4da4add0bc60996acdcd106429f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4ce4577ae7a4c564a22aaec21dcbdd75

SHA1
dc0718eb84c016ae08466110031b0f03746b08ff

SHA256
87da15a54a835f3d24cf4417a462040da37b7b0f984ae96d1cbd3ca7a8ca6d97

SHA512
56eb25bd4db9b1a527978745bc6d60834fca59b0d5b51069dfc34a5436b6c480b9fb05c0910208d035f511879c24ac5639e17958ae2569864cf00c4bb4ca360c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9cb04c0c8d06e4b342dcbf06112d1f4c

SHA1
ca40eef5fe69185137f7cdd32deff96c1f49ee03

SHA256
8d507f5e3aae4f33b39a202c304c7845597b3461dc538811ed66d638362ec292

SHA512
c3b05e9eb4b9de32dbcdd64a39441ce8498d5a30d3c322ecb4caec49dc908081a94c8d80570f567b1553344903353bd8496d9aa90d981eae717372cbf68f4565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77c0784e5348ec29d69bead86fbc5d53

SHA1
90bc077a328818127459bf8b1dddc9e14c23302b

SHA256
469f4c91bee46d3feda07682ecfdba301e0dfa3c8a756cae2a6eb6581ee9922f

SHA512
ceea8517c1e8b91857b7ee380ed6411c8d1972d09a1619650700bc3cda91caccbad49224a48fb7be0c6fe20c39773751f606e267ce697ce5458f03db6c9c6b2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5ebd1642dd121dd45c6302d24bb34619

SHA1
55687d67a0dd2ec21ec43bb88fb78ad0af7828b6

SHA256
afb0d26365e7affc95356456df03a5db5bdc2a336633165efc300df84215a7fa

SHA512
1f6943a8487b335d02ed3f4ca70335d5f077a3da869863fdec05d4d5ea98689e30a6980cf13b84cf575be4660b5b8c18b385e990a8ee968088c61434c55c7696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce8e802e5cd456d9d6534d8f6fa6593e

SHA1
636f4692449e01bc242ec6629169f036cb18675e

SHA256
74571d9258959278a6ac305c70cedae1d0704335a76639ad84dd1a3b01088581

SHA512
f6f8eeb3b5569075ef2568c2486d44a12e691520d77a811773f46cf2214ff4ea62c5ca20a7deb1260aba4d0cca2f398c181a2ec0e3cf07915e3fe8e64ea27ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58895f.TMP

Filesize
1KB

MD5
8c84283328adc5e9b3891948d4443b95

SHA1
74fb0edd17ac315607eaeeaade6e57dee1deb819

SHA256
c561586978d0b619ff65114834c8991cba548632849807ec41ff7a62ecbca234

SHA512
df7db1bc4e19e30c8e99fc317ee92c011a5316f642fe3bde5438fdb815ae5d9ee648e0af86fb9ab49bd7aa5941fc068ea0ae07c523757f8ad2629bba283d88d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6f9851ed4d1f69c4364f48884e26b240

SHA1
78c8bfeece287d8dd78526248a6d6cb43d5849d8

SHA256
b4d5a5897ed7302031b0271c8b3d7ed1f62397168443ef5b7de19894e0cb7533

SHA512
6d9d4cd593c21d333bca55af56286850521f1ce18a222d70b157fb3d8817414341533bb6bcbea5bca2f447168e7163c1ec381d60bc40c11c850b8f8cc63e24c1

Download Submit