hxxps://www[.]gofundme[.]com/f/jon-papas-memorial-fund/donate?modal=donations&tab=top

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.gofundme.com/f/jon-papas-memorial-fund/donate?modal=donations&tab=top

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
4924	msedge.exe
4924	msedge.exe
5176	identity_helper.exe
5176	identity_helper.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe
5492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4464	4924	msedge.exe	89
PID 4924 wrote to memory of 4464	4924	msedge.exe	89
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 1688	4924	msedge.exe	90
PID 4924 wrote to memory of 2308	4924	msedge.exe	91
PID 4924 wrote to memory of 2308	4924	msedge.exe	91
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92
PID 4924 wrote to memory of 1128	4924	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gofundme.com/f/jon-papas-memorial-fund/donate?modal=donations&tab=top
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4c3146f8,0x7fff4c314708,0x7fff4c314718
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14885015760727340389,7993487170796963579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a88f4b73c4d97db774c5d864d3b31793

SHA1
a3044c4d47b22e1a819ff7fc6575ac671176dfa6

SHA256
dabdbcc04039d9b5d3c68094472dd886450e8aa8fb8e98955f8aeb5933794fd7

SHA512
3701052a03ef15cba1c5aac337e7f730ba4a6239954f949b7c54dcb2521aa4c24881540f601dab93c4dba7a23aa76dd255b0c36d54bb5745f5fe0ee81a735850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f289ac9ce3742fee2c67cd936902919c

SHA1
c30561f00c38c70f9445aa68216dcaaa043ed1bf

SHA256
04313ef62893aeee4f7428356549263e2a266c305ad183684306ddf28e5a7b35

SHA512
b5e0189c8125f9b9b312093e470495b68a2900ab2a1952ea8ae8d50650c83845f25047458876b237f5d7cdb3a3b96b1d58513d8024b7c57d69620cd39406c093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6d4000b2b35872cd5c0a34bcc23131d

SHA1
7e6894c2734033a9d0b7b2bacf72ba59f0089a50

SHA256
096d84cd850f6764033857d40df001f18c5cbc57486c0fbc0dcf06ca44f621f9

SHA512
6d89ad3da596fb27f50b18a429adcc8e8df2d01ce3ebcba95e4dec13c67ffc7baa08329119cbe41c8ad7f4e645c84a6288b9d8f7f6dfdfa1d959d959217e9b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
048d581008550e8e1fb424d1b7a9df21

SHA1
8a8f96c21094b9aede0d32f6f8a5813410061c02

SHA256
3a15381731dcbdfb2ba20de3f59ca45c7b312ea13b07d6ac458c89091d721872

SHA512
fc3c459b9ce66598e3061e289e8e27ddd5b7b0b2aaea9c25d1054465886403e32400634376377b0b99adb979ea38da0b760769563d5b7222d5a6ae9cba0dfe48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00c4442ef6b04d2363d91370b07304fe

SHA1
cdd0b7753bab96689de0763e070690651ad0cbcf

SHA256
00bcfe08e0fec47cbacf1f89829276fa22a0fe42e85ae9d809f0dc1b66423e38

SHA512
25fe897055a7ce55a29989e5cee2f75cb4f8a37ea78de4e1e1fbbe229ad1fa6795fe03a302e7413ca5afc2983473c6408a7dde0dd3dcf1a3554d3de496dad7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
959a53b596c5899bfc50b3bb80412fde

SHA1
aa8f685029130ddb7305a5c5c4bc9a683c3c9956

SHA256
af103563ef22c0015a5ba3405f002519d090bed0d21775d2a7b3fd791d001abc

SHA512
261bd694fa898a68a9be2e341ea83205e14799669abcde93f9a033a4838a21313a3dc68e20adec19682b87226470a0c628b058f57b9226717af8a96310a4b4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
18dc8aa0c761bebd83cc231031ea95fd

SHA1
20fa4b42f1eb7e07676cc5f63c2dbfe1d7df30de

SHA256
e66c2601ba9b28465b7e7326808fb38e382e9fd95be5e9ccb460cdbfa84c0cad

SHA512
722c95ba71e1185ce3aef9e974b497a85f464751740de51b69bf6ef12fbcf6c6ceb77b8c1b5bbc9f78b60ed334256973219dddde7604e7cad4bab27906b33521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e2ce.TMP

Filesize
2KB

MD5
8c983deff4c8db0adb24bcd4610a40f3

SHA1
42a139c4ba77d03b6e0f061e8c9eff97ec25f41b

SHA256
ef36f95c62d50663137c51e562a4b78c18bab79f7b08a29ce06cf34ebd694735

SHA512
762ca477025ab8fe441fb768e3ddcdf6484e72398ad47b4539569b11b825dac75fc708826a7e60acba7f879e3fbfd3d2b933781c5fba812266758a25f382ec50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d59a158ce6357d16012533d30030d1f

SHA1
7f5ac1be64c72e3129b9787b5e2913c2d6e85297

SHA256
d09fb294a2380409c0554781158d39e8e293efaf4bec3c0a4d1726d87e3e6c9f

SHA512
b6d516a24d10d4dcfd9d8e6768f62be882a7c658e452a3ec3818c331cef3d040f044084bedbbb14847dae6f097cc7b3ba6c7578bc6f9533968f3ba0e1da47385

Download Submit