hxxps://user[.]jusaz[.]xyz/1f718d16/

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://user.jusaz.xyz/1f718d16/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
2788	msedge.exe
2788	msedge.exe
1520	identity_helper.exe
1520	identity_helper.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 444	2788	msedge.exe	84
PID 2788 wrote to memory of 444	2788	msedge.exe	84
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 2792	2788	msedge.exe	89
PID 2788 wrote to memory of 1044	2788	msedge.exe	88
PID 2788 wrote to memory of 1044	2788	msedge.exe	88
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90
PID 2788 wrote to memory of 4668	2788	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://user.jusaz.xyz/1f718d16/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba97846f8,0x7ffba9784708,0x7ffba9784718
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1770748743371299189,605391201796464112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
687877c68ea4a1b66969354c86c76601

SHA1
0a932cae38b75bf2db4e31332f41eed5d24837e3

SHA256
c1f5e4cb9e00787dd458a629c76098ef5c404cb58ca12f375cb6b17804667ed7

SHA512
2e5e213910e91d5e0011ea7684079b274b43a45cbc5674b3a81e5ccc1f03754b33239a67f110f3b7ba4226ff5d55d040bc9054dea1a1d7fa2d4c481b5b28cbe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
59209aab8015ce2ee008cf75aa2194e9

SHA1
a3d716d643616312533df82814a585851c26816e

SHA256
15e5c9ca247470c6225e834fbcadfb23e6ee320bde983a65dfddec5bf785e049

SHA512
5fd28613222e8cfad054af5acedb284acf32cd82b227f8b224dae2674e14eea3005d5f0aa29aedd12eff6248b717ceab828284e930c6e688b4b8175965d20fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
52527ec79630b1426500133d6e1b0ea9

SHA1
9daddb0d713f4f9f669dc59324eab7c4a4e19beb

SHA256
09823ae4ee57970bb834c17d9aa5a4f46b80832715ac296f932a0d8e2daf4e8a

SHA512
be2df5379f6f7449987c9b3d6eaa22c4a2b50a71b1b8bd4b5de24b7ff93081f2e84cbd44b8808afc9526532e06839f9363210540b058e0de5325934a5f3a5e1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a727c222d68f384375bc5845a9e91103

SHA1
1c0f133a79764747f0ac772088770305c545d14f

SHA256
c4a902cca74694dc0b4d30dbad18dbf57d243db0416fc7c4a3575cd89ca60541

SHA512
ed36cbac764fc781c1c65259d7d3c4b0567798e0344bcd5998d45f05c980bd4ccf02c9996f4a555e523e21cfe1ee884ee33cda2c9ee1d78fcfe483c54e9a1cd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9374f0fcdbf461038e8ffbc6d73b221

SHA1
d87f61eaf54f3541d44912b13d45b74654d6280b

SHA256
92f9e32d6758b9618be55aa3ac17eca31ba3c58201218c5d881e19099d9facdd

SHA512
0d5b89a8e6ebfc39dc883f1626154860f5382fcdadaf6882af1541fd6e0853db9b3cc406a67cd48f3bc7a89a9c27388b6dbf05db3e85cf8f6a7c88b1578b5114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1ab59dbdac369c64e42c780c6c4d1d1

SHA1
d6659a9be4ff5c9f354f4cf2bd71e19c26867a7d

SHA256
1b7de3ee62df73104b697906bc5006cabe28c0e2c65f865bbd58d909a37ea53d

SHA512
047a61136f904d2086175456a9219bef406d1b5756fc3b3f9119970368d0e6da419e1534b6eabda56ab9aeccd52166efaf946daca2402ac817de55c68acd7924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7fca9e5fc9ef4f320edcf1ce2b75b28

SHA1
a5bad396e7dc55f4d6c056bae373ee863e589b78

SHA256
a927e60ad5ebda33f9207c6afddd6b21b1bd9ee47b72815254e86f7483692b70

SHA512
d1494e3d3bf5a56fccf84ea889da57fc77f9989506ea63da99919fb03cc00794d1b9eb4eba0113bb914e26dee949cba9f8946e9255649c850ec62a5375506d29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
2aebd941d6f4875c237d5810669f3885

SHA1
0d92e7e56d01882ea30df24415186671c2f85b25

SHA256
8e84c59eb1ff13c87a8347e588cb08f4ef8db665082806ca085ab3ffcfdef4db

SHA512
968fff6db9ba3c3e137f4d56213103ac60217d042e850845ea3c88f410050a2bffc3c43e792473ed993e44d55c6aca3848e1a0340ab9688aa5792b2234e8c424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817d8.TMP

Filesize
204B

MD5
5de2a06267753ca4b2fbdb306c65c452

SHA1
b54c87c570eabbb216199340a38a1e7e87443fea

SHA256
5ccf86404e8fb846b7e7ba6a77f9e63b57985d554bdd5daeb573507c8a0a5d9f

SHA512
be18f837c2c696d14259bf150a0bb8dc2e22a0c2de9da77f513c3ecf6d1b5956cb80a26be5ec2ef0e43660f54aa6f99540e2fe1b310b1187fd7f5de6342d3438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4d97545a7eb8482ffd53327f339475d8

SHA1
b0f44c18456318e1d53144da77e5771cdd0668a4

SHA256
495b6649c89ce07c8ee110de85cd0105daadb9402e31ae84d71556f005e1fdf0

SHA512
bab90bda26d3d61fb77d706fb58aa3d996424b7d126d3c29ace35ba5dfa973dc28c2661e4f80c13876fda971cece0a0de2978f48e46acc2402f692e724e8a022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1df84b04e2a2f462fdb62e2d94a2a06f

SHA1
0d942b7ec2e8da7398393b57d3a53a8eb2d6945d

SHA256
beb4acafcd135ed935f4aa2d3db2ef3aeb6df1822d4bb8ab012ce9d9c2b7876d

SHA512
cfabd9d9dbc8ece156ca33ddd0aca363c0184074e582054a70ae577300700ddd236134577f9d7ea5332239969ba23366a53aec4f74dd5c049c2b29ffe32615f2

Download Submit