hxxp://instagram[.]com

max time kernel
37s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://instagram.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
4012	msedge.exe
4012	msedge.exe
3188	identity_helper.exe
3188	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4116	4012	msedge.exe	84
PID 4012 wrote to memory of 4116	4012	msedge.exe	84
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 4988	4012	msedge.exe	85
PID 4012 wrote to memory of 3272	4012	msedge.exe	86
PID 4012 wrote to memory of 3272	4012	msedge.exe	86
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87
PID 4012 wrote to memory of 5032	4012	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://instagram.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa000046f8,0x7ffa00004708,0x7ffa00004718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6655728684581411080,8559200394023454061,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
75KB

MD5
5c3f39291dd2e4ce17c8c4cf95018e08

SHA1
12aa94e6011c093ec1a971cfe5a521ceb4b84402

SHA256
0fda8592a2c3320aa46fe0692ea6108ad6f664ebe490edc15735b8480eab6396

SHA512
a67d6ef59a7f4af4ad9a63d819c4136394036dcd1a80878d38f6a63df52a36086bc3c7e5210ac50e33afb6f5ff263c56d4f0d0cccd55a76a8906d882c8d51bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.instagram.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56c458f0d85b78e2b1524a7b11f52b04

SHA1
9e58de69429c2fe3fd1f738d688b9338c2b79f6e

SHA256
374b75516039342bc9a6d1b6eafdd4f016c760aab5f8f9ff6ae6b6ac7313d2ae

SHA512
65b3ffa32a2347465359998ebd1eb0630e8407ef48fc3976d8d32ad907954fcdadecca6814f90203e90ba16157daf47d9ce4686c608526c43ccc6d9e19f85498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b6758ed8ccccc3542f312ac6123ce5b

SHA1
2243eb91505688bb410375d0646b413363f80c9d

SHA256
08894001e76549ae13daa83806e6b3d7b4f636e3e2688b120282d9e04a0b0302

SHA512
29778d229747ad089654fecba9f0323cf232386214f6c36b0a2049c0ca0a4274dd83d693cfa2fbbeef1b838b23e0db7685b786ed64b90745ddd2d99f3a6b103b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a52139fd82a68b0c9a48fdddc37f7d37

SHA1
e787a04aa06e94255f409b0f451d188168770e5a

SHA256
c6cbaa97c4bc7ccb71adbe3eb6b7734b1b962ce9e09f518e48f8e70e66e6f111

SHA512
f4bb879e305f3ddacb6c2b51ebfea763f324ed88ee6d9e9a3825c2f4538bd1c8b6478f63179a49e13d37ac6580163cfcbf982c293bfc558327ac6db6ba7de588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

Filesize
167B

MD5
f02301857ecce9cd296aeacb77dc7589

SHA1
7357c762ed36919a3b42d09602664ca55117926a

SHA256
87d344967bcdc9b483cd1759d5d45d67d687b3dcb35d80260e11f418ba7a5917

SHA512
9900ecd449004c140f38d5d0846a1ea9cf833818acf2be919b3b29fec9463dddddb8ce81a8a643f89cdcb584c9fdf48b1b39107b8266e549d92925160783a767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt

Filesize
217B

MD5
b105ae13a97ade7b5f08afd6dfa866f0

SHA1
a552684806e0a982b8f4e6f00340692b73ab88ce

SHA256
c1c10de71c7630f5f0d4ad4f1ed8d50d08c850767aa2c86461a190f25c287151

SHA512
b64e09daa7d0247602fc8324db19169e4638050c106dd827163a4dd06755b47c99cb3d21b810dd204d5104c8e0adcfb22e77a8fba999abab10201350ee776e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2348e52d6de9218df880d9a88ad6a5d8c2c9555c\index.txt~RFe5797ea.TMP

Filesize
95B

MD5
047cd9d2f9249e65db8ea538d84264c6

SHA1
3b3a67548d857b2129fac3a91d84b649d462a274

SHA256
92a3feece84f9dcbabaaec8821c5aae16f90ebeea12ea4ef275f2ea9e8664172

SHA512
fe8905e84285f024a54c969f55489cc8ae9430d627880821f90f6fea7452ced3f9043138dc1d8d70b2d0fa6f0ba4672bbf110fff687d919c455ed3257a696014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
94bea105a12e2d0908d1f13a040743d7

SHA1
3eb3c2f6760db6d1516c443fce04b9e11644eb86

SHA256
2e08dfff266e353ac8b33c2cd520d96b321ce075953a3929c25c3e7f20b2ada1

SHA512
7bd441633d711f150c51798c71759b6083439fed9e5769ea2dfa17e7cd5182abd3b0d0d1614c43e1134ca92749f500e17ab113037546320b217352eda4985638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bad4.TMP

Filesize
873B

MD5
a4966350a8151d36b6ccd5d5a48b5d1c

SHA1
ecf9f77f65dbb4899535dcbf3987d6831e871fea

SHA256
0f56323d2ea058531f4d10d16dbbecc72adf8dfe916780c99ec2b09aa950b7b7

SHA512
66ef11887413cf86d102fb94d43fc17829b35d14e193b3ce87f497fba445128a8fa8a2ee234fe3056e15b34b486b6de9fc9b1cbef32fe4e4156bd3962a6d2cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f0c7b60bcf857e7d37864a632a8eebd

SHA1
902ebcde30a471cd118292223f42434d6ed6144f

SHA256
4d3ed4bfd97b46640b3137d8cbed4cf75e1b8b8fa01f5b638aec6405874b176e

SHA512
ca155e1c304089270ccb6a2248e3fc21c2680875e6c2b2d9d79c7e4f84d40c0286e9253973e58a39a0aad509fe807e6591c1adb8c11392dfbdbdb3e3b18e76b1

Download Submit