hxxps://us2[.]concursolutions[.]com/twPopup/popup_OnLineCheckIn[.]asp?carrierRecLoc=HGTEBJ&carrierCode=AA&firstName=Jeremy&lastName=Hamerman&deptDate=1%2f22%2f2024+9%3a25%3a00+AM&deptAirp=MIA&carrierName=American&lanCode=en-gb&contCheckinId=

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://us2.concursolutions.com/twPopup/popup_OnLineCheckIn.asp?carrierRecLoc=HGTEBJ&carrierCode=AA&firstName=Jeremy&lastName=Hamerman&deptDate=1%2f22%2f2024+9%3a25%3a00+AM&deptAirp=MIA&carrierName=American&lanCode=en-gb&contCheckinId=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3544	msedge.exe
3544	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 5116	3544	msedge.exe	85
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 1872	3544	msedge.exe	89
PID 3544 wrote to memory of 3300	3544	msedge.exe	87
PID 3544 wrote to memory of 3300	3544	msedge.exe	87
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88
PID 3544 wrote to memory of 3188	3544	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://us2.concursolutions.com/twPopup/popup_OnLineCheckIn.asp?carrierRecLoc=HGTEBJ&carrierCode=AA&firstName=Jeremy&lastName=Hamerman&deptDate=1%2f22%2f2024+9%3a25%3a00+AM&deptAirp=MIA&carrierName=American&lanCode=en-gb&contCheckinId=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2c3546f8,0x7ffa2c354708,0x7ffa2c354718
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,3967283714723186987,17451149724770216487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b1194b171fc41a8f6209ec3ff9162006

SHA1
5854951dcd45ad885cb045eb3d05a429dc9824ef

SHA256
eeeba7dc23c17913caa24e7f8befcc9ba9c83fcfa2fcd3e43b38b8ae1bf433be

SHA512
8baea695f61ee8ee6f754dd5cc2e6916ffcc9f0497700f2a61f7ac990d9d25098a131648f3b7987a957f91b13dbd8361fe762d3f5b455d6ba4215134cabdacbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ac186ee5e4673a595fd1a1ae8dc9e287

SHA1
ff5d739a75541607afd954092e108764289b8317

SHA256
60e109a9d72e6ad9ef7a585bcad1dd2960db9ee91c4ca75719396e8210730a6a

SHA512
96537763716db6936e0ed26d42799f81d2ab61962616c6e34b0c0432f33817c9b239e698f0299d7d16b6c06c36fda7d8847db4a22d8f9b707d88e2b857c2b54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce1a2dedff0a86edc18969a4308ffd46

SHA1
ada35721185b6dc4ffff5889bc28ca1dd7246f6b

SHA256
4a10470af194ebeb49fd9a3edeef6d229bd1a653d1bff2019bf6837f9cc37d65

SHA512
7d968192c160c04a9ba4bb04c04f169b0fd79a49d4191d9133307fd59f95ebd41acf6e22b9cd03cf7ef67961ef661933f6dfbf2427b3d956a5a81ea3f3effaaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73e48466c6104eee122665c96d7b1769

SHA1
ded014d6ce104ba3bf6bbefa81b458167e8b3466

SHA256
9170723e15111833fd27b31e516abc3f3333c05e16ce789dc5ddc0a92c05d213

SHA512
7e9e7bc2009a75d3c0f175b85db6ffe33e1f617c611ebf14e90f3ec9a94b9b8e1cbd898d55af2ebb35cf03ca28c41e318d072c73478aba71bf218904429f485e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2b652e7c8876c5265e02d86c8efc9525

SHA1
e0b276098530bc4d4d13c28607c69b3f95bb4fff

SHA256
1ef617674bc52d6e1e9d9979687d671cf3f6595948363a8edac30fd91667c184

SHA512
30727827b4b1d870ed7eca05e161a9a2ade23c78238c81a6488be7923e24a1b3a98bed293f2e416b5ad56d4988cce7cddd0e870bf041306315831e3ecc9531d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
47c7ded25ea5e094d31862b54a4171c4

SHA1
5b3cfa64abf5f33f1cbce8dbd42419c23144104f

SHA256
2f6360eaa978e5bc1bad73f40134e7098db0fbc73e2efeea37c6d6fdd212906a

SHA512
7f413a66575196f91fe3c18718852f8632759c3a71b0c9e1c8984893c0d44ac9cc40416023ea2570cbea4c63bd7065729c8099bf8f029279e3af823714048a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b33f0a7e00ceefdff7543a75d6f9aef5

SHA1
7c59307e50a73a0f5f1487a89a502c8000485b2e

SHA256
8d1a1ebedfcbcda0ccd0f666d420a562eb0e05d00e656fb0a21f30b56fab8e8a

SHA512
849102b43d23f5d8da8ff2f8e3d4f1ddaf215718917afaf13a655e23b780297b76682c34cae95f5912b56fee0f05b64597adca80078268cf9e5f551905f2c7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b9395293c95a9236f36fa4b415c7e5bf

SHA1
6bb29751f6e7a8e79f0fda5ca36c21887a2af3d6

SHA256
f17d95d5e399df6b5a1137d11bfe32e331e3b0a07baaad1bf7b662774651e7da

SHA512
60ee632f2aaace51ad2bb7fecc1bf47dfae679be7431c17a2b11e8131a1cfb5d11f8e004d3bf2cf5f70aef3a605af08d49d41cb620a88bef53510470e2f110a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
efb71f85d8afda921df9cfe7444e7f1e

SHA1
745074f270726c9e706df2f7c3765214355a6606

SHA256
f1f8c9d3d2ff7bcbe23681ac25987fa4c0c35b64233b477d1368550fd357eb39

SHA512
c425b9cc249c8beac6ba2b0456a29afe2a68eac17e7b5a43e468cbfae16d504ef20d742a5796693fdb9963a24b74f9fa963867a7453bcc29838414313a874ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c573.TMP

Filesize
1KB

MD5
96d7d931d3bbddd8ed0f9e85cf2c8fb3

SHA1
d84d1961c5b7bf11eb217f5df6dac958b98b4d57

SHA256
34790de0e56525256b012d7a3809177a87af5012acfcfb628543bd0dbb34a9b6

SHA512
d9fd4566c6ecced6300704890505d3ecdbe8f3ddb15ada6023cc4261c2d0f47f6fdd11ba011f6fd6c4a00ec3d67c6eb926167535ce03ae9385e09a5d4138f511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36dc64b9815dcf1193cf1f3da28fa46e

SHA1
e3e92323aa8b66963e74236cdf87a12ee07ab4d2

SHA256
0282b7ba107027f83660622fdc7f2983f9e9bbb45a13b3d043872efc06faab08

SHA512
3c3d4fb85339816f25991ab8307c40b304ae7b2d5f23f2f8911f94309828f30227fa2a84a0879e3996dde1458e639f64cd33d39a84123ac4cfc7788c832854cd

Download Submit