hxxps://sourceforge[.]net/projects/tmacro/files/TGMacro2[.]7[.]Portable[.]zip/download

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sourceforge.net/projects/tmacro/files/TGMacro2.7.Portable.zip/download

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
4432	msedge.exe
4432	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3256	4432	msedge.exe	88
PID 4432 wrote to memory of 3256	4432	msedge.exe	88
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 3288	4432	msedge.exe	89
PID 4432 wrote to memory of 916	4432	msedge.exe	90
PID 4432 wrote to memory of 916	4432	msedge.exe	90
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91
PID 4432 wrote to memory of 4860	4432	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sourceforge.net/projects/tmacro/files/TGMacro2.7.Portable.zip/download
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff983cb46f8,0x7ff983cb4708,0x7ff983cb4718
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1364 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8882652896042777841,18187024127514601839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
7be152a03820886d6c27676918819009

SHA1
1d85bc861c1ddfea9d9ba52cd0df1df6879354bd

SHA256
fb0ef80b7cca389db600d3fd9cf024db3cdb31d37f0d94e180a3ff1ba09282ea

SHA512
fa304f9ef9067f756178e53251389362d569acf0fb059f491b106eb0e0a1abb12b34c3f09ca09f0e98eeaa120b33e1924ca358af115de3d26f324727cf1b79a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
fd7060d63b6bd620d10bf5beb0b79145

SHA1
fe389ff2c7fb0a56de87b97e5a02fcd461323e36

SHA256
710bb27029b7d71dc5ebff09be92fe3b6c7798eaf188c28a184a80a6ef196f70

SHA512
b665869b0efc0d3c133c4eaee949d04cd35828922bfb3e131e526ef828a08d0790c6d8c73c9f074adc47c0f7b21642f71016856666ffde45246242955b22ef13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
59424eca72e6c12f2e8ac8f417eb159e

SHA1
18feab5c13d9c6e6131ad9046561907f52122d63

SHA256
09ab939a86790173196d142a59e03ae1e9423cca339d3043124d43ef49ced0c3

SHA512
680931bb0402dce62218cefa425404f1804b43f5d54b0f7599df82ea795ca2a91b5c7317b504305c1295252db090b3f3b2b636a478c71e842eb2397653deb971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3cdb05baf8b7ba21828548a399b506a4

SHA1
a74e3d7a898eb4bff103a865c452d7fcb8abf59a

SHA256
065d9b0932713b4a48b3cea6fbab07df7b9a5595c9778ffeb8e40d4197939427

SHA512
3837a948b33b8c568561590c9f8d50162ef76d5c5d342f553708b1f92fc8c351d5e8e87dc994a104bcecdcf0081f7380c5175bc38463491fdf4c78d81447ac66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46a75e45db6c5749c98fb78134a58971

SHA1
6fb4667f5132c606a2b61adde9af628ae1882904

SHA256
c4b58cc12b12e623ed9b111662ae172d73743b80f9f67bbf47d3f2cc38214739

SHA512
afa6e44a72df17fb096fd8ab8b14304d8d6b9a60e078745d3ee691e222f5c878a0cc238cf71e430e7c81dd642b15edd303b85b3b678e57965ef41e4072c59e73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
59993afda32e9319d862c3cea195ee64

SHA1
2d06eae365d21e86bef53ee718f7316c20755e61

SHA256
e682f134ee82ad27c1e4a7a35ac00cfc083098ae449de961ef8cb6e567dc3947

SHA512
5c7eda3cb04575cb38bea71dd9a6ee9fc6367ebe4230b752100bc8c6677798f82839fd70c7e162177eeea9927856b4458f96de68b6448e42cf01ab8fc8e51d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ae83492eb4e0995c6992748bf1131281

SHA1
e7347267614087e318271ab0894ccb7309131ca5

SHA256
2925a9d9cb6fbe584189bae5f227e06b37d999d31fbd61532786e430bfec2677

SHA512
084600843ab0568e63f7d113ddce86c2a358836510c626a8a665787cd0be62868ad689b7594f6ea873eb661728299db8b6a6b19a68dd084d81716b62d7fe9998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
26cc1023470661dd2edd9e51f255b191

SHA1
1d03192e0ca5a9d84cf6c9a9c5fdc9aa93320b1a

SHA256
0942c226b513a0f1a8affd1aebf9dd35b9d7a7da2d91f09de94ba6147c5fa6a5

SHA512
be4e7344bc8682441743c8c686c01205e89dbe472552cee3df310662203e27cfe439d51a97816cecd218a5b1fb2f66b96bad1c0d714a0424ff919561a6f6e77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
66f3d08d9a488260b2a569cf7de187a1

SHA1
3bd17b7b90e8f63ed57fc28be6234b2665057e09

SHA256
d2ef82b4e476be792a483c47ccdc028243f5258bbf6b45d2d8c1dce84b19e3c9

SHA512
dbbde211d3996a91a3933a39aa67847e129e63aabf19673f5257992bb2f9e37e32565d85cf3884b27a5f0caba2d87a07a11d787947296e4dfa94f54f6ff6ee72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
1237467a93d8b19af113ab9969f4f2e5

SHA1
c1f36f1caf4ee6e1e9f90341251abff6069e0cb5

SHA256
bf8cfbaabc34919b072a752b04424520de1ad5bbc68c71c97ffd3a9b60735b31

SHA512
7e03774b87003d3fb7de99b1f5b43d7a1fb62d21693649279ade838290fbea782755aa92ef4d6b354d15510b2ec0291009274bbd96a74f0808cdb2a7b37c63eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5831d9.TMP

Filesize
370B

MD5
8b45df000cf5e3251e053ed12ee218db

SHA1
b54e7e401c747daca3f81c68d1f8ae3ee23d374a

SHA256
ee9ab4acfad7a5f5adcdeb3376b44dabf9f9069dfd8602d4bde9e258262faa40

SHA512
9f85be580ca9b8d70e1f318d8fbd35581020fb7692daaf329af0980d6d480747a9e04cabfa46f309d17346aa886c884ce69a0998f80fd48454e21a778d9ccc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f989d91987a9fcfbfa944f6f4b162167

SHA1
791edce1a5acca5b88ff33d82694f48e69319a8d

SHA256
b4e07f0dd821f53aac6b708f2a98a4eca7218302cab6de30c61a232faa9352cf

SHA512
159f10f48c5fe7f22332d0f7cce2bbab9e1e90af268a517779ace6d69b5b01860a0771a40832dd634222aee6d95e52c80cf984939293f6b15e5782a01f6e29a6

Download Submit