f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d

Analysis

max time kernel
1696s
max time network
1690s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.htm
Size

1KB
MD5

752a1a8e638938f8e466e838b330f7b1
SHA1

5a66c6f7dc710496af18360253677a62a5bc260b
SHA256

f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d
SHA512

e6f1333f3303b5c30e59e13baba529279fadb5a83b3984f0f83bffd69978146e062ab82a01e04fd7af2bed8a85aa6512acaebf24604c02a317ed8b633d736c43

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
3304	msedge.exe
3304	msedge.exe
3624	identity_helper.exe
3624	identity_helper.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4240	3304	msedge.exe	86
PID 3304 wrote to memory of 4240	3304	msedge.exe	86
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1556	3304	msedge.exe	87
PID 3304 wrote to memory of 1460	3304	msedge.exe	88
PID 3304 wrote to memory of 1460	3304	msedge.exe	88
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89
PID 3304 wrote to memory of 1744	3304	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b6046f8,0x7ffc8b604708,0x7ffc8b604718
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6127144245945152127,16387021029445083193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
33fe73b86741d3c7bf7aee4e6abd0024

SHA1
16c0fd3b400e26ce41e1ec337ebf7a5a1c6a6099

SHA256
78a1d099daeaa029ab292accde878475a424108e9b13346f43b2a6a4201352f5

SHA512
fa59e1ca9cbab458629ddf2bb4c4d76ca0e8d72db1f901963b7187edeb4c92725d2f91e13a40c31268532192c0d5a42e2a5c292c06b1cf1274e9ba7c06161afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
340B

MD5
c32f166681915b30f1b1d518bbdbba25

SHA1
aa5c4573ef1cb73c22c79d341eae6bb1384312e1

SHA256
2ec2a8444c50ccc54454d9216d6bc20259eded16f17bc789b8a12c7f1538fa61

SHA512
762a5d9776a4e7f08356eff9ca74ebfd2b3499438766c58fe9f9c85fa77a6159c81e96164590c608b71b7f694a93dadb844adf8ebd7eacbde1c44fd0b2383b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12695df9519ffad18cef34c4c703f613

SHA1
9a1177228fffec0c53a4ca8b6c6f3a55df7d4264

SHA256
da4a74e4a08bca140275f1232d5ea6271373cc136658d17d3ecc39e72dfa836e

SHA512
a0941d19baca87ea12e3b6d412f020915f971f8b06055019f0d96b7625bd041b30468cac7e66092bf5052b2fb19ab68c7479170c2b47123c34daaecf92cddf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e3822f3cd7f499b60c8a105ec5d6304

SHA1
d41453eb07613944933e8b82b4b816d7dbb7b710

SHA256
b363e8ee9876dbe214e069cc935cb141b3bf24e5345d6ad0784092fe31dc90a0

SHA512
7f6e31b3be13dc052e1d1a113e9e99bf052637a75e85fd8b8fc9398ac5e7500bf8acac728cbaafaf83269a8c50ae9b4a51c0285ea2cd72cdb8cf1f848c894c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4cfa744f24a831fa62aafb3479c29cf7

SHA1
2dd083105ccccca3a51862c86c45f7360ba01d5b

SHA256
03c175db20c97fa113bfd3f6179c5fed382e090a6f6aace5ba6af3161b3e2c3d

SHA512
93108e85ce583ed7b537fde10bdacac724327b0f86536d11a6d80343ef4e4ba00e9322af4732a3d33837293696474c947df1c1e6ceff795ca06a65e2ce1efa68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
a5ab5210bdcb23ce244cfb7c76aeb16e

SHA1
d70f9616df0778ef0268499050a7fab9add1b589

SHA256
81194fa781cf09865627f836e4aa9a64ba826eb043782def5a771e72d64ddea3

SHA512
6877bd57eeccd52b40f33119159b3ec73e653281197810e67d4f0865d3a4a7009ea7448d93a5c345e7ff04a75c208c0416faae9b3e355231b0f298e2e385c4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
326fd3c2ca76699199e45af4b22b6f8c

SHA1
09555e17daaaa1022498a7b703e94292517602b1

SHA256
840b88ea54776bb7dd208a52b591bdb11beb0073d3c9deaf61895926c3fbc58f

SHA512
c0f4eaa96437adb9f685587c0bab97556747761fd0e7013e786096c720744dafeeb20f51b3ecf49810472d34ddb087f258242feddb99bb184cc1b87dd1de0b89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
e27670bcb9b1d425ca4198afd9d39a2e

SHA1
20e9397262699921672d99d7ff2883fa5daf556b

SHA256
e55f8ef731eb892a0773560d8db98648b0fd1df329d5682127eb6579c8a54911

SHA512
b0717ce30120ad0c3e058bf2fd8b004a702c8046f5f211e7b3b1f6182778e1dd6b902bcabdfcbe3516369404290a49ca754778e59cd7023bec71f9b61ede5d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
7d249c5bfc9f14f64d7cea6d5368a139

SHA1
71a1bf8d6b3a51a9db7468d5a1aea86327ab08d5

SHA256
c5f193b15a3a02eb088267fa1502cf6cd772bc1f116c86a5694a3562404b7997

SHA512
f42101a57c878b22a977eb10bdbff39b718d4857bf6f8a07e69b87d8b9238013b215a72a41b0d7e28f1d154e9ec6540a8170f6401c6482108266302245051bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
2d8b0d70f82b4bf6d5144696676a807b

SHA1
1e522eb23b266bf54e4885a35ae2eeec0e77e37e

SHA256
0571d89ba675446ec0010d5bcc3f73d6b08ac9f662a64c7a5cb1d0a23d63b198

SHA512
76ca99ae0e4b239610cf36fdf0c3bdbe2410b80c5951921205948a1303fdf688d6ce3714b537d21617df5397c252d39624763a582647c7c34d90f100b8ed25b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
a2a5121275729939e56e68a23c6fa435

SHA1
fdcb6c08a5d74b5c38851bda7e4e5c1533660bfe

SHA256
24cf9a42e7bb63f88f814fa0073a20786631d64ce6b1f842462264647f9e31b2

SHA512
1e24dd8567f19bd21c4beee0bb781deffa28660ed663344bb7bbc53ca8a517f6568e36e8a33910bcc2e8a46008cb53410d77073711d98ddc904ee198a318d475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
30138c79a15491bb16034924e7ba4346

SHA1
78a0473684d768d3f4cfd4fbbe6f33ace677f3bd

SHA256
a52040633fa4a1ef22bb021a10c55e36c2aad933727715accdf23d93087723bc

SHA512
b1049764352a4ed9308838039a0595ce8abdd179e397d5ea284631c7593f5160ed1aeab84418d7a7ff743fd95da1b6890536773df05ef447fa16ac2540426eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581b63.TMP

Filesize
536B

MD5
4b1aa968d461911622578ebb12454cb5

SHA1
8e4032312978f71961957c405e2275561c7071e7

SHA256
f6f75d9e70629374f82495eaecc8078a5c0b3782f504e7eaca32d9ab21afc08b

SHA512
794730ce7ade4e2b64d7692a8de1cf121b7bf2ae284654a64d4abaabaafee20e8d8360fc4c5d60319d329026c21142870d91245b4ac34ac019ed35c8ab33be91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be5d30fb127ff58e36c50ff9eeb10d92

SHA1
fd691cc99851ea6b574e8e43e3c8e93c88f03114

SHA256
7dee5e60e8d47103a96ae0d73dc605781128d19e01796433881243f79d0e773a

SHA512
fb2f87e7eb52e1b1a0a379877a4cb40f17d70d06029a6514ec7f84384ec3e23d57feee700cebbfe25efff322bd61f6b94b4ec8a0552863657eb9227c238bd1f7

Download Submit