e0f4512120cb416da007f11f983abfc2a8b17c68ef00984851308a5a488d5c92

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd6ffaedeaa50ec5ccbe6c2f3e911d96.html
Size

56KB
MD5

bd6ffaedeaa50ec5ccbe6c2f3e911d96
SHA1

686e674522801a59a10bd0ef16ce533b41d645ca
SHA256

e0f4512120cb416da007f11f983abfc2a8b17c68ef00984851308a5a488d5c92
SHA512

24216e1bc908a05a86463ebdba2b05513048e3fdfb3a3a8d4ff4400ba28bb8a784778419e5479dfd599218ab4eb9a61abe4ed8b5471a327e3ac13c2f50414684
SSDEEP

1536:gQZBCCOdW0IxCXT+AUVmMDlnti8cSses6eqqa8GYayMAWeASmiuyySy860UCG2Ir:gk2A0IxdAUVmMDlnti8cSses6eqqa8G5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
1724	msedge.exe
1724	msedge.exe
3608	identity_helper.exe
3608	identity_helper.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4500	1724	msedge.exe	89
PID 1724 wrote to memory of 4500	1724	msedge.exe	89
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 5016	1724	msedge.exe	90
PID 1724 wrote to memory of 4764	1724	msedge.exe	91
PID 1724 wrote to memory of 4764	1724	msedge.exe	91
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92
PID 1724 wrote to memory of 396	1724	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd6ffaedeaa50ec5ccbe6c2f3e911d96.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe778c46f8,0x7ffe778c4708,0x7ffe778c4718
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3136137790813660153,2550473476898530846,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
70cdcf1a12b1ade90c615a3b8a8432f3

SHA1
8786c3482e1f6649bc0c11370b405ad4ffc22682

SHA256
91e2690b7f4005abb82f74b377bee8442cf4dc32864398bdc1540979b8dbe51a

SHA512
d4251c4d83f88e4640c109424f231ff5f2478b09f4975296e300411070cd2e624c50005b60d96ab2d3c345ba6c7e9dd51294243a5da48b99c68f7486a343b6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d26408548cf54898f43d5d4570dfa2b8

SHA1
9f33183da09afd79c8c8f122d7653c4e9ca0970a

SHA256
04fbb74d995fb09c644f347d05eac31b63c78d6ca85020331c856c0b9372db45

SHA512
1a9b2dedc60b3b93c80bad4f2d0e9871cc2f99657d9b5222e6a6e5e2c9f13080be99b350fb101d48df3f897e9f16f4c0f66b379f6eecd72a8ea636cc0a475e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3b410130b22ca0cec5483ea816a3c49

SHA1
49dd8ab64d2b5c98f96421c92e7e6e260b8fd984

SHA256
e289c62d5a5ebda5d1d199bf5be9cd8253d011ec9c5d72eefae8697c3af3ca2d

SHA512
7f0d6c141d984952f06bed1fc7d8da203702dd744d1b1814591f4ecc5e6724723a956e484276e6a45be6c24680062a29edaea2d12adb77cfadb3d04714c5ca55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
589353df7e75c1d46d4d7a2f2909772c

SHA1
d6ef5f74065b2073e8626d43fb99bcca7eb0c4b3

SHA256
ebd5a4054512ffc88ed5514e6a9a7054a8fb3d8864c97273301d436df558775a

SHA512
331943fa8860fb6e1fa8704f231517ae45d4bc751a2eebb9d1c9e3465c100cca21ad821720e587036cd5c6ec3a1a0520c088c6eb6e637152ed8bb6df905210a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
86651fefd88a1178f3e4a0b218c9c46f

SHA1
15448c247cb3a1e558c1c3df36261b97f9dde6d2

SHA256
3b66f64ba54ad3d4f8ad6d4a0ea642f918a7ba9d7a2477b5a7cd06b24ad79851

SHA512
0d14b9a08a13b5feec8799a793bc94b0e7133daf7b8eecdeba5651e29bb706adf6ff600109c9c7442f6c8f28b2e87b795b424801a6c6330f73f0193dfddf5f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb51.TMP

Filesize
370B

MD5
e0ff44172bb687d67496df536804b002

SHA1
f396f2fa581df962e4b32d8885bfe9c3198b65f0

SHA256
4d10159764cab301ef5ab3559c762d5cfbe5af87e156a81faec6126af1b5d316

SHA512
d25b3cbb3ee2beaa3ed2566ab3d4232d86e5de7b3d0ca6f18bfb7905d354a6d8129fe6915b884a1754077bfa4526a292017b4008090e158dcfa87506a1fce353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
428a2acc4c6e3648bfb4638c9ff66147

SHA1
5c3c473429b2f39ad088a16bbadcf69ee5a8ba31

SHA256
24426b363000b49cfaa912213315ba81dfb32fc4c4bee226834b0c7dad0731f5

SHA512
e47395ef13000ef8e38832130ad79178d23e4f03a724e6dccb1d9e2c2426065149dc78544a89d7dfc4a92a854b7936b7e5680c7d45f0e1f2975bdf2a7c281d96

Download Submit