hxxp://anydesk[.]com

Analysis

max time kernel
1681s
max time network
1695s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
18/03/2024, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://anydesk.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2564	msedge.exe
2564	msedge.exe
3924	msedge.exe
3924	msedge.exe
2236	identity_helper.exe
2236	identity_helper.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2888	2564	msedge.exe	81
PID 2564 wrote to memory of 2888	2564	msedge.exe	81
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 4100	2564	msedge.exe	82
PID 2564 wrote to memory of 2020	2564	msedge.exe	83
PID 2564 wrote to memory of 2020	2564	msedge.exe	83
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84
PID 2564 wrote to memory of 4976	2564	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://anydesk.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd4f113cb8,0x7ffd4f113cc8,0x7ffd4f113cd8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,1991499020701142358,15048394399300636720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12b71c4e45a845b5f29a54abb695e302

SHA1
8699ca2c717839c385f13fb26d111e57a9e61d6f

SHA256
c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

SHA512
09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce319bd3ed3c89069337a6292042bbe0

SHA1
7e058bce90e1940293044abffe993adf67d8d888

SHA256
34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

SHA512
d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
d0353a2645e3ae003a605c1f1e10d87f

SHA1
28d413a6d6422499292c26dc6dc1c40c0566a8af

SHA256
2e182d674b4b3b5336c52c6bd53f295d4558673b5ddc3e4af1ff09254ba01293

SHA512
5cde97da91725c0a64d54c5e97ad2966f94215d7125c4012def4990134b032d4f173337dad7fd519f4c2abd40db106ca0648390664fd0c94a3be41e03b6e98f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ebf96da3af8c03c929be34f647754425

SHA1
3d230061a4140da0e738038e6e939060c7b89456

SHA256
662de01e05ebf9901fc39cedec6eae95c0159b2ddb12d99bc54903179e4f560f

SHA512
7c0149b1147677c6bfbda05ee618ba15923ad2cf40cd62c7993206f3fe2a39ccd2a84853d7bab4fc57a20a5bf79fbd0a46ff5ddf95fb8affc71532d10292a661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
709609cb14e1b20ae6711cb79f777f50

SHA1
e687e986dd02e1ccc04d154bba56f859b27539eb

SHA256
0376a4abb09460c9ef189d0524d7918b8e9e1a34b326295915d4567c9464fb54

SHA512
7f478bf383abf8067a9f2b57b7222088d44ea56659bf5ac89fa43b29c2e19e09e613a82a1ff9c773b458f9255a56d3158091d603f0c6906e03448e64d2177099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0e87a3dde8a5b96f11318137a9130b2

SHA1
99459134c41ecb9f25c8fedf0d53b8b5d402c00d

SHA256
8be48207eb829c046fe4e09b7e36815e54afde381322b12f04b40d98e844a0e6

SHA512
11fa2eab6976272a76ba603eef9ae563353398892a08a3dd296af4fca2df84d1dc026aedec75b11d85ced482f9f1f3690cfe412ea5df2b01ffaf4371527a6e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt

Filesize
86B

MD5
26001c3d815e4953113b3e96c0a7c2ec

SHA1
c09cd23696b799f5ddda8a354c86d903defbd9e6

SHA256
e4c327089fa5299f04d3e0d72bd4dc7457e48ea97445d16ec0e64e12881b1c11

SHA512
de54603c380b5de7b2f912945d9e5d88e0111df8eec4411f9b5e38fa75dd321f00df1a5a6daeb62a5f162649e4c39d76663d060969aefd39dd7e4399bcf1145d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt

Filesize
79B

MD5
1c25305fefd22246c18cd6139b60c0d9

SHA1
58b1b98ad03b9327d5bcea21e54b310a65532d19

SHA256
dd19d6be7176bfca9306e3463970d03c099af91a3b7ea919dc9d93900636e1ca

SHA512
18e537ecc93d556f9e1ce43060895617511d100e13689f691ffefbafe7b180568b38494f7f7a4fde691c8c0d797ade93fad3ceb7b4ec61073c019b9fd2b4899a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
89c2b64dd61c097573e79d40c89a0722

SHA1
158dd36e3a1dfa7b33cd8f56b08166006ad3814f

SHA256
ef73c21332150107cf638ea314d78ecf5249f5ae725a53b1ac370e055c512e6b

SHA512
f26104a3df4340a2df6a6d2f2ecc9a7bdf0195285286fc452d9e062e0bbe8bc81ddb398aa72e56146c632b623cd59a68f9fd19d92c4199cd713853ab1e3ecfb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b96d49f652a1fafbfcf0585ecd8a0a2e

SHA1
42ab70e388b27c2aef60a2fe1751ec78570d3462

SHA256
ae7b4f610251a54b6595428ffae96f6b983eb214a204d7ea308621bc0f116043

SHA512
fe8efd17ed658367dc440337f9fa97a79bbdcf8ccd0bd5aa82d2def1f5cad2e0d2db9baeaf14edbe0cf01ebfc1649405626fa629445df3b8d26bab091b1ac31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
77b43f40a848cc4db35be757fa96c574

SHA1
dc8c8e0af12c572f5deef57f09c4058f50d7ff89

SHA256
98454c3013ffc405c56614f0dd2fd5e19ef8937583631231ca2e385c8aa08041

SHA512
2a5a3ed3272324ff04ccbedbaa9ac5c88fd164ce4f6eddebbfae580802db47c5098f56a77c3f2d50b236a5e4a43e59ec0c96b021449d63f42e046e65af365a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3d1779f6b0ddbf9f4878a030b63cac9a

SHA1
732a0d260a5359b6e7167caefc0c75c4a6384f8c

SHA256
8b291fb540d2bdbf70220949a9cb6ef3b4d4af6d596b1a87eae2f60aebc74885

SHA512
b50db9f46197cb4ee4a9f5c9a251d57a2b7bff9523a1bd1335a858151c4e104b8a3af35fca3340875217d94daeaba28c49921ebfd272678195d289ae9e40d042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d84f.TMP

Filesize
1KB

MD5
95b02a468964eb35ea3c05a506027988

SHA1
8cd58ffa6e91bf7731604d2d53974de4cc939314

SHA256
0b20b82ebe540b904c5953646c0d330d11077208b300b510adf61bba70ade539

SHA512
e147aa36b63a0d36e6149c57aceaa6ed9cd78e93a4577629bbe7a63d29240e16ff2cdddb3a9d4d4957d4752045fa7a51f4a9250896fc2b4998414b0e96dabaf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6341a037b1c2343aadced738661f41af

SHA1
8360fe3dd76db30de50c801d9dfd31b50fc59d74

SHA256
16d0d06ca76f0b40bf4e7c44539d205557f52b5f002d41609805d874991accc2

SHA512
11218492e546036062150ef412ba9a27649153a010727d6bc6dd5d99a6a1d41e9d557dcbb8bf8c79ce2c967b7e2d9f76b2243dcd1dcbf43952677c027af0d112

Download Submit