hxxps://lively-sea-0fad5e203[.]5[.]azurestaticapps[.]net

Analysis

max time kernel
190s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lively-sea-0fad5e203.5.azurestaticapps.net

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3316	identity_helper.exe
3316	identity_helper.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 4140	3224	msedge.exe	89
PID 3224 wrote to memory of 4140	3224	msedge.exe	89
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4984	3224	msedge.exe	91
PID 3224 wrote to memory of 4296	3224	msedge.exe	92
PID 3224 wrote to memory of 4296	3224	msedge.exe	92
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93
PID 3224 wrote to memory of 2748	3224	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lively-sea-0fad5e203.5.azurestaticapps.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8033746f8,0x7ff803374708,0x7ff803374718
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1868 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13221183137838413688,13397829444166825504,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
36f2f0e70651e02ce52ae81b4c58baed

SHA1
e57edc9f4ae03537dee3e0000715bb4143b32159

SHA256
9d36faf4e8ae5df3e40fe9b34368e86ce4bc2296f92a935f5a30abb421488718

SHA512
39c1961ab94eef4175c242cd2861bbb5a1baa19416031645fa0edf029f6d9853072640e6243c2b170a56eccb6c14c164c52cb3c58b4efa8a3595950fa0eaa861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
b6c704deafa88f62d4f13d2b75941f8a

SHA1
afd22142ef5419e75fe0cec9ad641559a9c81732

SHA256
9d2743b732c427df723f22a037a5027c129fa175ecbd0d027e483f3e6ad916ee

SHA512
87b3262c6abbada89eb0cafd021024314cb8ed8ec3fa0c809e30ee01cad6e638bc12176d162b21905af2c5cd03df10f6b788c9234dc32dffdb383bda9a75940c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4d31f10fec32581f165117145f0928a0

SHA1
9f5ab97efaead3a923b59d9d2c13a22037db866c

SHA256
fa08a53d604792fed1d6c0b53b322abb6dc27d7529519e05f256ef62300e6b27

SHA512
ccac1e9cf03c9a6989d6d87244a85b0321fe13234463db8f0fa298a9470dcb8230cfaa10329d8aeb2ba68075629eb090b624437cc7eb2fb3154d15dc41053e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
366B

MD5
f3a02dcd5e697d51379c92b0c61921d7

SHA1
7860d7da57c9a289feec43b47ffcb5b39e0b2640

SHA256
03f2b65783b4ef30b7c48c5bc3828d53510aa632c9dd5c6b692127afb832eacd

SHA512
bced99b8a99a998fd08550e56941a9d6188248f6e1a0102bf160f5203ecae8bfe52629e4c9f6abb152de1e4391d328905dabb1989ec093010649eb622d9e657d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ec5e862253b2726fd7b1d15b3ef12ed

SHA1
e9be9436ba7d615ae4f3d2e4c548328ace510af2

SHA256
6bea55a03419ebfdef38d83d50c7667f99df2ba23cada1f92fc7cb399d887421

SHA512
b287781469aa10da42aa243a4bdf0457c1d91309349d42078b20a802058c44c2b7789d0017f5f0b9b6939d40d5087e6e809f2032eb5ec96bc3f79da949d35154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1744c5beda39ffd723c9ce6304bca9db

SHA1
fc93d079bfa9dbf929f56ddeb5cb2c141f2d1b61

SHA256
a1240d5a136ac8e8c20ffe7fdb055e95b12f3d8778c7274fe360120bed9583a8

SHA512
21e9f7065e121b5aadad17b899526efc6c793d5f302e81f9d9af6383da3b4f7782700fa3c1db6c042da175a645ac1595114aaeb1dbcb008a3c72aad8d66f5a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26d44b7fd718552ec8dba76ccbedd87e

SHA1
9aedc6f15daf1b9b2f9cb79c031c6ee3348b8e21

SHA256
9d1935a74f08cf1803a1b34082c9782c476627ccf165c7d6726c394db8c36b51

SHA512
765a5fca84ccaf89124063c96f04286a6f77ef2bc6ecbbf21641016bfbae22ffced52cd4563d1a6e9bba157b360f302a227ce0282a05088b30ec4010a0ce4ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7420d84324416562e83d873636ef685

SHA1
f15ffe8603cc1b512732d2e0a19b6dd74074c5bd

SHA256
0ab3e81cd75973e076ab7313bbb1be4d4df2fc0bdeb10907ec4e63ef10cf5fcb

SHA512
378571d7428925cdc6755dc4d9d469176c9a16950b7f4bced624f32405ab5b1c4afae540769ce14a58f87077ab51ae55d10cc390616882922687e93c77840f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f22fc3999dc75c57fa046bdc56ce028

SHA1
d2931ebde71756f867d11a4017d0565540fc4651

SHA256
628a368ce2bf95125ee928e81e3167461c07d171d9e9b66db2ab6fbb8c2802f1

SHA512
9e53db9af9e79f83caa306572d60fb271b2371174a65a366ee2afc160aa2031998283ee1fddb63b34520c0434989fa4212c157d0f1f0e710cb003ed8b97f133e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
d9262c2faf542fe37763dffabd5d33ce

SHA1
ec76d16b34fc02853fa610b3864431efc1e88e7d

SHA256
10d78e1acb091a80fecc1b51f904fedeeba0aff848497981bca56f000d0bf428

SHA512
4716c7f414f79e6a8fd31030d065aabf8c37a3d1e5a62cf1d8f843e0b65ea3690aeff96d3a5732a4c2db465c15e5645d72a77fbff75b125f1cbefa54af550de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
55b2687a5543ed8c91c158dbf0c8090f

SHA1
0ae376497aafbf01031a37936372b83384f7d8dd

SHA256
1ae7bd82648ab1711697648b053e810436043dd8f58fce870aa743ab8561ceee

SHA512
61b0770fd2830f1da5474bff264ff528a3cd0d239fa944ad08b7132749bd58575c01c1721e97e08f25f258c3f6b10a180e8aeeb88b1937b7cee59c724ccb4fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
6235efdaa790a2c830a012125ba15b68

SHA1
db1fe1b71f3c5d0d2907e3f3db39414bbd444937

SHA256
f8aa60383427f6fbc4de287673fb59f2cb22e78198d3cd379f31993180ca797c

SHA512
641eee2bcfb00b0652bd93337f9e5e80f95ea80b911ca4fc779b1355df145207e460db2f1607e7f2114f60b1f3d3c7ef4eeb10227b0c88815a0e1ed97b48e0f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58388f.TMP

Filesize
538B

MD5
67f5cd05147e1ab8e4c2a573146f31e5

SHA1
f419c77eedee4ecc499b1ed3d0dd6cf7356c1c41

SHA256
eca90e60e26df06149b3cc173791c80232163c75fbcfe3ed086498e983d44cdb

SHA512
2986a3c17345d56a0810018d9e5d11a41a74801d809b70411a83be87053b1d2b560aaaf32cbbe35e23863273ed5984fa2239de5f2a5d9cc85859f5cd5e50dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19e1c12121c73e1f7a7563c0282de415

SHA1
83ce716a3c27b3daa3546da4125ec7e594787b41

SHA256
1c09b39b14fe79f608e9c517f4a502f35b07577034d216ef969b731f9ac4d5aa

SHA512
789280c42b3c50b2c95a3136805449b547c048e85ba9f09e11e079acf70843be778c0e2e9fb5586889454f6b684ab3af814ab35486ce349a637f8e9da7ced410

Download Submit