hxxps://l[.]facebook[.]com/l[.]php?u=https%3A%2F%2Fmangaweebs[.]in%2Fmanga%2Fstrongest-anti-m-e-t-a%2Fchapter-319%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR1mkymszT34ji8-xdOeRNJbQf3ZXyKsQtMYZd4HBJoR_WhzJ4l6YvvwHAc_aem_ASPF45ySfOsQLgXqDlJ5qjaslhmcQXDWsXyWCIwzHJ6FPYQL3TOoq914ne5Jo9AHMA6VwsVN3Q64Ton2ZMe2E28D&h=AT33IL_jvkc_rG6h_yKtcZAo059dBPCHKMj1wOKhSfwnqtL0G5LnmvUE1XypOsduqOkr9ykmx1WFswYZdBkTItMKbUDKpu5cuzVS8MRe3rtUQ0go7KPgvCbOZJ4bQsbf17yZkvknoAMp4NRjxOMj0gs&utm_term=1&utm_content=share_button

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://l.facebook.com/l.php?u=https%3A%2F%2Fmangaweebs.in%2Fmanga%2Fstrongest-anti-m-e-t-a%2Fchapter-319%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR1mkymszT34ji8-xdOeRNJbQf3ZXyKsQtMYZd4HBJoR_WhzJ4l6YvvwHAc_aem_ASPF45ySfOsQLgXqDlJ5qjaslhmcQXDWsXyWCIwzHJ6FPYQL3TOoq914ne5Jo9AHMA6VwsVN3Q64Ton2ZMe2E28D&h=AT33IL_jvkc_rG6h_yKtcZAo059dBPCHKMj1wOKhSfwnqtL0G5LnmvUE1XypOsduqOkr9ykmx1WFswYZdBkTItMKbUDKpu5cuzVS8MRe3rtUQ0go7KPgvCbOZJ4bQsbf17yZkvknoAMp4NRjxOMj0gs&utm_term=1&utm_content=share_button

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
4292	msedge.exe
4292	msedge.exe
4016	identity_helper.exe
4016	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3000	4292	msedge.exe	85
PID 4292 wrote to memory of 3000	4292	msedge.exe	85
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 2460	4292	msedge.exe	86
PID 4292 wrote to memory of 684	4292	msedge.exe	87
PID 4292 wrote to memory of 684	4292	msedge.exe	87
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88
PID 4292 wrote to memory of 5060	4292	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://l.facebook.com/l.php?u=https%3A%2F%2Fmangaweebs.in%2Fmanga%2Fstrongest-anti-m-e-t-a%2Fchapter-319%2F%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR1mkymszT34ji8-xdOeRNJbQf3ZXyKsQtMYZd4HBJoR_WhzJ4l6YvvwHAc_aem_ASPF45ySfOsQLgXqDlJ5qjaslhmcQXDWsXyWCIwzHJ6FPYQL3TOoq914ne5Jo9AHMA6VwsVN3Q64Ton2ZMe2E28D&h=AT33IL_jvkc_rG6h_yKtcZAo059dBPCHKMj1wOKhSfwnqtL0G5LnmvUE1XypOsduqOkr9ykmx1WFswYZdBkTItMKbUDKpu5cuzVS8MRe3rtUQ0go7KPgvCbOZJ4bQsbf17yZkvknoAMp4NRjxOMj0gs&utm_term=1&utm_content=share_button
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffd71e846f8,0x7ffd71e84708,0x7ffd71e84718
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4951478560609926108,4479159069274777663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cdcc1456c66e4666c0d1951cf7b10d10

SHA1
24fcb6c68fd2d862ed84e6e57de6e5a801e6cade

SHA256
58be552302463fddcad65bde12d0f4fae60d97d5555d41c6bb83490c594dcc77

SHA512
ec179007054bc79dddd2464581a8fdc3587f55aa3fe5949b0700635775233afca2e1035ca8b6ed71174d105b17ef42d71de95747b60c149a99f19cffa1a197ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
470B

MD5
396e962da51ae62a18c2a77a0cfdfcaf

SHA1
5c74bbcf303c459d1c1afa203cb1227355c2cd09

SHA256
18366b1734623d1eeadd849d533318da2ad61d11af6436650695a32fade87260

SHA512
00ce67b0055de11c103e89156c2a59f36f4daad32ebba27cbfe0b14305828cc013cf6cda7cae9b1d03d5ccd67a892da3e9b47ce753f4990d1b5076756efe4ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd7a3bd2d54cada6b46ffc20fea59224

SHA1
f0b2cd3e0d74ea7564ca1ac716141a48b1bb7a86

SHA256
83845e7dccd388f5dd9d737317329b3c521c7920e7fb99059fbdaea3a37fc577

SHA512
8c732cf41e8d17223c83612db918b87e15ccca2588515e3d49a76f16318ee1cd3d4b3915c0720be228e3d96855d33071c0305472c7e1fcbb7d96339fdcf8da54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17c89fa57e539158a6d6c8488a78e823

SHA1
5aa37c498972cd5523dae90601a64c1b90dca18b

SHA256
c52625d5893d283f44d9a519b65b29eb349ad3a73d918ddd6ed00989ce0cc997

SHA512
3f04b946c45aae287b2acd636b1ea8a2ad99d739f8b8662987b85fab5ae6a69f8572368f2fbd320d9dfedbc56e10e5b399854349395a942b21232700c47fcdef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
c51e9119762b3106ef97daa6338ff927

SHA1
3efe21c500dd06f5f4a80de659806bb77ef99122

SHA256
74fbede40b7ac9016a05a9be3cfe2ff5b0c48b7a1507d185fad23906b8271d0d

SHA512
b0188c37599a2ddf381ba5afd0a47f4c61e9916065c62df3da758fd41f88f9adb337867d3148d413ad799f93f43404a9a4613c4a8dffb89bf1f267a6db7c943e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
441c394d2f84b5bc7774e6c0b829c861

SHA1
981c6f0876f7c83c71160e2a63e3fbebadf75ff6

SHA256
92d7e6fa0b55a2c0a07b120d8470f6e6a66ac1677186b12f4befdedccc27085e

SHA512
2927944b51539914b87b7027523b1351295d1f51db8a01e3030614b7a1f856a24aad022b914e0cb3b97b6bef6ba7b2d192ac5fa7b9c7d66a7e9238cac7831f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
91936751f5f999c3a90627d69a56c37f

SHA1
eb4523c2ae791677f9cfe4e16551ad1fb8f5cf7b

SHA256
d4fc6f5829e897d588e4d99561a8ad60f986ab56e974732cc9e321af86d33e4a

SHA512
26e2293cb382ebcc3a5148155654507e515686658390755001c6e73bda2ae4f6a751af21b7f2b137c76e1a938310fb3f1e84138081ac0c61d4cc4049d9632475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579990.TMP

Filesize
705B

MD5
8541bcf6eae9b734333e7b8b72587839

SHA1
6e936a150695e55deddcedf5aa2289f0774317e7

SHA256
1871e27d0cd4903be9c2cc97dd1ac94abf36ff9da08040723e7fbffa1bb18396

SHA512
883d3349d59910067bde9c80e4533b65e33b02949a548a1533581e63b319bf0723e4879121887295f5ec4ed835b81ebeef9b27dc1f373ee233fce286429597de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a1b1370c3879ae1385a3ac361dac8e74

SHA1
5d8e9d96b52e0a23c42958160c8d874349e2428d

SHA256
d61735f42c5033d6597286e5d701da2f1cbfa14f73095825a44ad07f7a285a38

SHA512
675b9693a3b2d75ba3de356823f7d3475a6fd7d79b8dae366c05bbfce2ad717af5b74575467c678d3891936ad09576c3cf5c714c90217a30d5ce5dc2046292e1

Download Submit