hxxps://group-post[.]com/

Analysis

max time kernel
186s
max time network
208s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
05/01/2024, 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://group-post.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
5984	msedge.exe
5984	msedge.exe
2260	msedge.exe
2260	msedge.exe
1928	identity_helper.exe
1928	identity_helper.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 1520	5984	msedge.exe	79
PID 5984 wrote to memory of 1520	5984	msedge.exe	79
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 5544	5984	msedge.exe	81
PID 5984 wrote to memory of 4784	5984	msedge.exe	80
PID 5984 wrote to memory of 4784	5984	msedge.exe	80
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82
PID 5984 wrote to memory of 3636	5984	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://group-post.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff990283cb8,0x7ff990283cc8,0x7ff990283cd8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,3190905152187611572,8930903392470832241,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fba38883c4ea1c000dbd9c38d017e733

SHA1
85e0906708a55073287ddfa21f757162b21c3573

SHA256
9e233584c57cb57ff648be1beaa1fff2112600fd78a0be082476c9ec5cfc5972

SHA512
a832dbfc9ed009c686cbe003fe04a67898c37f6cd3e0c19ff8a6d4af7649a8c7e36eeb2e2e4c4206752da80fbde7c26c7241a472d4098b1edc5ab4057d54f1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e69284fc1b43188267a2c4d7116158ec

SHA1
4a7e3437a6c2fa2c176063ba9fcb8f4107d60a91

SHA256
60d572757008d728ec4c70fcbcfe96f416307d3035b0330cebf91e973ecbda93

SHA512
79d3d5ac1ac8092fadb5e00e5950f7006e22b70e3dcb3478bb03df412a8e739375e388d030d0af38a6f839d6da3d4a64f93c7a05a1fe2e5120c5bab1eed2c664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2348373a554990e0a62aee63467f6a86

SHA1
1d9c43018209bb40d762163c73a57c4803aea47d

SHA256
7dba639a9ce5b4f5e4edeeeab2bfcadc57bf4f0b58d2bad0cae354526813c996

SHA512
b98a5a926a620f518817f8f76d46869f67b22a1342a0ceda20f3dc4840ca77cd55fbbb32a6245550ce460fd802f7c0945140d0f20006fd5f475426ca7029c130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
327B

MD5
8e01fbf9bdfe45a35f778575422ef2ae

SHA1
b186ca05c45baa3146003e4f484f73df55763cfe

SHA256
8204e21fd8d3fed3a93daf83e8c81ee6219ebdfc701fee344c8247f075ae0c63

SHA512
8e94e9b2b381bebdceea59542463dbbb29ef409da3cf46789e4bfae41dbcdaae7db7f6b8aea0875ba4d6352e84321ca47543d7847d14682c2ae74bf894cf4c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
bb56561f70af8cab688fc879441a3ef4

SHA1
de04208c90b7a1a6305a1a97649fe7d2a2d27e94

SHA256
f207b335106d8946a1eed3ece33aebc78df79ddba1ffb08b6623891b0d29850c

SHA512
ee45121452b5055ce4df2b69736a465d4aaf0dcdb59b6194d455ab40c11645f70b60ca2ec34f9ba2854d02c4b0a00f544528d94b83c99cafb4484f1595c65b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a4d529e999d004a8883c3e4f6edfdae1

SHA1
7de45c85289f389da5fead4e9ccd40f37777f53e

SHA256
0a66eb412bda013feae0e72a27425b7e8ec65f10d882b7ac9d1386cdfcfa8ebc

SHA512
d434583e672bbe13ae0a2f9224afd72d40b67ec3068d910e1017094d6c7ed5e1433c0e0dae14e4c48e2ff088f4c0be734d77339747910c38afe2a5a2dc0cdccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
80e5758d629fbb7b7124d65a6d81aff6

SHA1
65c124b8cdb9a225f787aee05a4bd0eafdfbe8a7

SHA256
8d6ee427c625eddb492d2794e8b42d481358bd06af7c316245204644f43fc972

SHA512
dad6bf64950425f7b7fb15b79704c5837d63c465ef9892892a6dca7f82c24d3f512f68a83e57cd86c7f7ed5ddde5fece5606b4213b07c27b437821dd0a05576f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ecd3338620e1270d474a5e65cb944a1

SHA1
fe90deb58adb4aa7822cf3136c27503ab344d252

SHA256
0e41c42ea7eb70a42131672152f72928a7630df02f27dcaeb941e2838b14cf08

SHA512
6b2099fbb4c10a33b3d4519852a370cd2ad2eae63200d5fda9128e03c42aacf3c2e383bfebb913ff9ee15141fd4fb6221d2e19fe647dc8b53b1f1fb619d8344d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
de8827d93011d8af360f82cc1f8ce73e

SHA1
87774343c086d15d6da295268cbca6fed80b621f

SHA256
511050e65ef86e0692adf41262e7be695993b28b629ba66f3e174e27d78ba6c5

SHA512
fa0527111401d82e4e05a16d1908ff9e149d396ff088d970855755ca5a8589476b19a96746c445284b803f3589f1544a02b4d67e31bb56c596a3b79f49d7948f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
6c8c28fdc5533423bfc8b617d31b49b1

SHA1
d89cdd9312fdd46152fb15de14511f8da9d3d69d

SHA256
262ddaac1f0e04e9b38ee7864df916ae87ecc11f885b4d1c1c3866b16ab297ed

SHA512
600f82705e7f75fe6268fc595ccc5458831de1dbf89812d5ffee56a90c08e6c77ca3cd535465b82e427caf25b5a7742add91e672ffe7a476ea5a3102806d34d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
351bda6396db9e2eb69f4af8a126fd7e

SHA1
413a7f3d950a5c8bc1794632486ac62b0a3a1e8a

SHA256
f8f9514defc928218546e46e193990127e73b100e5ff1317389ded732cee5439

SHA512
db7035e13906be6769b39a5e41657da4db296820476a9bbd009d20dbe0aa4deecbeb47f2f84ee24417f3320bd8360fbf3ed50ce5bfe85038b2fa4834eb84ac8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
f16f825bebe4dd8545c01ceb9a42bc8d

SHA1
fd415a107b256dfe2b2981ba6fb4044bebf28863

SHA256
30eb42ffd89fa4db32ca0766d180e608b339852536a5fdd038aee52fed90a77b

SHA512
2ddd49a1d5c4f8a33836ebbcf332ec20cf4c5dfee29e6602ee5c17e01abb28d9cfd5c82fbabf56cc551e401d9171a21f88c000b86e55a1813f97c0304915b289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
baa83539c2479ec058bccd751263041b

SHA1
4b6f1785e968c5b4e25a9fa8fc276437c56d270e

SHA256
dc788ceb89bfcb85d7e785d8f3b311aba84fc421900ecacc32b935429a4caaf5

SHA512
2547f406a924410708ce69bc85cfdc9e7f8842c1c374cb84a2cf54e772ea41d2a096123454cdb087d7937265687e997e3b7375f5639d3314bc519ec2ef8cf5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58fab7.TMP

Filesize
537B

MD5
466e44e2330223a856c77d486e10d65e

SHA1
3efff97036efd17633f083999bffb3c9cf51b995

SHA256
4d52c4388f66f5e9425bae109e4bbfdbbeb2ee1f24161839dc4c2bca2c53efad

SHA512
99dbc89141251aa7cb20aa0fb45de762081adc52a4fef10d3297733880a784757a17bc675596eae970cfcb5db9727996073a2391d312e0906bb14ab7af211e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36ee8805ce5fe45cd3a984c92ecb42eb

SHA1
308ea1387c63793997d1c48b72e91f0e65479d84

SHA256
4340a32568534108b7d70628aac406a873706608a8c503b3e23dfbe9d67788ae

SHA512
f3a4d4b8168b6660361980f3148076c605f8629bf032609ea8b882553cbae6b38202212535c6d8a5ef1929546b6baa955ba424a697fe09b67a06ab9efb2c5eac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e63f91271fab820d6afe1ffbeda28ebb

SHA1
31b70c92f055ba011d2cc27a3a873ac7cc95113d

SHA256
388acebe6b0521275125b2e058eb45334ab4e44d8a9fd434205c98af9f004356

SHA512
f645b1f2106ba61efdc06353886a65dac95086e910245fa0237326273dabefb71d34a2c22b984ff2683f8c31b0ea194e59ba63b16d9f3be61e3363f1f91919f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
06e1bd04d7bcb272adad79b1c61292af

SHA1
90c2d850e3d7f567b3ca644098cc7c21f15884a5

SHA256
7112d9c9755ca433e528c3b43e7d37e92ea5b5491aa124067b16bee1018a4d67

SHA512
5200f041736104db89052e9ad648b9205fd9cf31661c3a4da1fcf1773022b2eaf3039a7cfbdf7d14d9d4f9df4a0943eecb05b3d9f7728226da9615c2c18dbfb2

Download Submit