c0d61d905a463d35a59273a5872614dd14018d069c271356d95fb941b5194504

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b96c2c00536a5af54b08b841de38dbb9.html
Size

63KB
MD5

b96c2c00536a5af54b08b841de38dbb9
SHA1

4573cdf4ad4f0d2f56d8442ca5fbe566532f4424
SHA256

c0d61d905a463d35a59273a5872614dd14018d069c271356d95fb941b5194504
SHA512

d11826f5acd54553add286b0a26971a8289823b056f0b60fb0a18c101fc46bfa85ab38a6a795629d7bacef7123ead6f9a7a158ec0b2f84c0b3f66db2ee02a004
SSDEEP

768:x6B2db6OHzuimyKL+3W54yUMHHu0SV7/eSLpMAFTvfPYmNle0hB:x6B2dhT+OyHu0apM4TvfPYmNle0hB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
2428	msedge.exe
2428	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3420	2428	msedge.exe	87
PID 2428 wrote to memory of 3420	2428	msedge.exe	87
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 2452	2428	msedge.exe	88
PID 2428 wrote to memory of 3440	2428	msedge.exe	89
PID 2428 wrote to memory of 3440	2428	msedge.exe	89
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90
PID 2428 wrote to memory of 1748	2428	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b96c2c00536a5af54b08b841de38dbb9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbb0846f8,0x7fffbb084708,0x7fffbb084718
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8827607979281574978,7005638588690818235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\315e1807-7c49-4ac9-8bc7-85c1213e96c3.tmp

Filesize
370B

MD5
0e46db359be78452fb088998b45c5554

SHA1
b9daa7203225e7beeb2028681cf67fbc2ee157df

SHA256
3fe4a25465349227627fcc5e775f93e6b49e6ad8fb3ab2fa7c63a791928dc4f0

SHA512
a6551b2a93b460abf5337a0fa11efe03ad9203843a9c2e8e90d61fc923393a38b1f927a60063d336d17aa8a08a873a7febbd0003a04902f3781fb580c1b3027b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6cdfac98-f8d6-4fe7-8b2c-dfb002d35484.tmp

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
248B

MD5
15b3203e70f6c169686e55f29a855c47

SHA1
e8e5af99df35bb2861804f161fe3643c0c47e86a

SHA256
43597dbdcc4219eaab05328c9d2131fc879c69920207c5b29b82103e608a0b19

SHA512
d0f30a53149afef77b99107deb2d3d21ed1e5c014632b1e566360c4e388064420ef06805ba9b710e1d6885b30ec2affb38107af3ae777ba5829f9c4e0ce11f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e759dfe5201db91ea70b51e61e6c016

SHA1
8cd75c025f9ecce77ef28ef513918bd8988ebf3d

SHA256
f09b96d0c85232fe95fea7db74ee7e19e9262b98ed0163a0fb8fa4978ecc34fa

SHA512
62415fc436f6b6635bb4b459205d6c43d7ade5cbeea1a5bd5a6fff0a46df7f5c10816fd380a57fd9c5af156818ce6a9d869dbce3ac3e38f3ddfc2ce4dfa50942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b42dd9a69f333394b826f817f419bab1

SHA1
9e704f9b03475a040cea7221a5652f560207175b

SHA256
0fecd9cb1f191d78d295258b0a321bb637181e6989a9626ecaacdbd858ac33e6

SHA512
4c484ba957fe47ae04663c222ff2ad2494c67b2f7af17d72f096d55a3254f5588ac7aa0dcb70f5c9886ba7ada0fb5c1baf4a4eb7ad390d4a6a999f13917a6716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8656bc873d73cb2e3b20298216cb2ac7

SHA1
9473eaf14ffb5bbff4695cf90c26f34fe4f934a7

SHA256
ce7e061d77999cbb523cb99281d256868a6505a3d807ad46367b0a4bdbb26915

SHA512
f518292becd090f169b77585001416ae9c7528d2cade33d5eb34c5a493ab64ab448b9b8e16515b810c392e9019388c87bbef929c8a8b061a8714cb8bfe824eee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
fed3e513b33f3cf460f0e7c87bf79a64

SHA1
71b1f579ea12f45d7b9c2d10b65a17079e5dc88d

SHA256
8ae99528663d5f55e9adaf58771ef8eb91fbc523b80441785c4ad236c109369c

SHA512
ecf226a805558b9d764f0ba42c0ac9bc36c7157d9058a9d1c3007e7d27ccb3d6bf2517c59c92f04ed3d9162c03e4d4ef331cb86426d1e2db238907de0fc7410e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
418d20364d4c257ee54fb66af8bc28b1

SHA1
ca34222fc14866c7a2dad6501121a99de4c96496

SHA256
ab417956c37f095430a733cfc84a5deb746e1493a4b07d02b66c8c477e5a0c87

SHA512
c8bd7207b3cef2413dc5239dc729ea78ac542b3ee58d14ff9aebead261de07a12af63e4e3f927675e3a3da6fcb3f89478c12513131cb992f021017454cf10fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
e7557b02dd33596e3935ef5f4510233d

SHA1
c444cf7a714ef51a231f1de77dd105913e24cb97

SHA256
ebae13a75a4d3d933899cd5a484bdefc45e5e106a7049a6342b272ed5bcd1940

SHA512
eb3088913d45cb1fba33511a89735128e5f7aa33cf8ba185f9c143e1d47eb943997a61702d5d84fc2d661b1c934ba6975d7b1d9e63422f139a04131387dca4a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
c9d97b4ebb70da6ad6e9029eeab48ab8

SHA1
53023c83d14bac1e67562db058f3a43421cdb00f

SHA256
04a7f7d8e999afdd0249ece51df682642a3d72a3fb31149ccf297fe205eeca11

SHA512
dbab7749901664cc42a0b59541232d149c39c85409130b43a460cf7c7914ccb505f386b41651a84c31eef73602e97798d40c7fa4417bacba1c2d8220f9d42aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a671.TMP

Filesize
370B

MD5
7b587bf509c75306937e87b8db97165c

SHA1
7787d23d4207e5a23ce5b025249222e334a035b6

SHA256
be93de188da59fec7cc45cfa0632f0939b7af34f3b91d2d33dfd372737285c94

SHA512
1a35db4b10e1acba26187ec172b873964418bfae70230eb7f41cdbaa24739070ebf1f7a593f09128f74a2a7692d0cbe4b1c8c0cd171a62d9d1ce2560e1d816f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
83ccc9dfea6f185737b3537d25591707

SHA1
0ea98dae175d5d370b411b6e2546efc4984fc3bf

SHA256
9a92a5124d9370c7067877d985ea3a0b2779ed1c2a886d908225ad9355e07e3f

SHA512
cd9ddaf651a6d53f7be1d6f7dc4610f51ca82e8b4d46909f51dc519efd5dcde33795bff26946ff9f4f548732b296055767bf236f40284dcee118ca34055a42c4

Download Submit