hxxps://www[.]freelancer[.]com/users/login-quick[.]php?token=30b3628412ea618dcc3f414b266ae263302b3e1b43e6d2d885225319dabe8e68&url=hxxps://absoluteepoxyflooring[.]com[.]au/0auth&user_id=13769623&expire_at=1569845677&uniqid=13769623-38750-5d42d7ad-e72874f2&linkid=0

Analysis

max time kernel
56s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.freelancer.com/users/login-quick.php?token=30b3628412ea618dcc3f414b266ae263302b3e1b43e6d2d885225319dabe8e68&url=https://absoluteepoxyflooring.com.au/0auth&user_id=13769623&expire_at=1569845677&uniqid=13769623-38750-5d42d7ad-e72874f2&linkid=0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
1548	msedge.exe
1548	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2108	1548	msedge.exe	85
PID 1548 wrote to memory of 2108	1548	msedge.exe	85
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 3536	1548	msedge.exe	86
PID 1548 wrote to memory of 968	1548	msedge.exe	87
PID 1548 wrote to memory of 968	1548	msedge.exe	87
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88
PID 1548 wrote to memory of 4992	1548	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.freelancer.com/users/login-quick.php?token=30b3628412ea618dcc3f414b266ae263302b3e1b43e6d2d885225319dabe8e68&url=https://absoluteepoxyflooring.com.au/0auth&user_id=13769623&expire_at=1569845677&uniqid=13769623-38750-5d42d7ad-e72874f2&linkid=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7dbe46f8,0x7ffa7dbe4708,0x7ffa7dbe4718
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13157274606198892754,11726914998209898828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:6080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
dd6bbff28654340e2d81e24397030ad6

SHA1
4bf376e4b091427e8c26f3a2c1e9f4a4cb7f3b86

SHA256
525c09d1866074514b018cc66d0b82462202ebf48b502f7d36739dca4cd6b41a

SHA512
0e03acdd4e87cd087e5060ca817e5f809df5488fc9909abe8b3e4a4cbe8c042e3db45084a6f0cd0b00924663c6bcff9059ed7aca9c98f704ea7dcf057d66166d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d106074b02ec61323198edbecc4f0bfe

SHA1
0bacfee0818f0d754c8c538ffa1fc0d256ad99f6

SHA256
5f4368a3623a9191828e5191d6d17e91f4730c7339c538e4d45894508871d07f

SHA512
c5aac734c96c9d2f1e947540494c6072986c97b57aa4c123554ab93a4247c6fe7b17b2f5af9dce435cd40da0047654f56a2416f22a1f79199e897250a54730d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dc8c8ae1161ea5c8b764d925c81ba6ba

SHA1
fc524a85d0ff402dd9e7745b3f8d1d2387f9d1d7

SHA256
4c95efe48e13fe009607c0b9354fc69fcedcca4f6647ad1d6b5d8558320c361c

SHA512
ba138df7d8418677f85e0deafa647934a3843a86d094a9618394548f06ae84a7908a6c1bfb81bfc79d8b37c7b23e9ef2d466eeccf7a9b076fb4dcabb578bbf76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a3cf2a9527231174f4a0f15b08d26d3

SHA1
c2a6f690079a32d197ac867f6ab91cd3e47292be

SHA256
9eb129dfc0fbab2e44143b7167e6d04ce13e5d9c8f5534bb3269cb25d2921e2e

SHA512
54b0cd2b61a657e1c8646c9fe4d3761b93f421d5c6fa54b4ebc9e783726f9117081588698f28613b724b0b8df3bd2a8d3741b11ff7b3d328425e545a3cc7a2d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
904e1abe2a7c3943b016f06f7e80fc49

SHA1
380e725ba1ddee6331421b36af5add49ac85912d

SHA256
36a76664fdd5aa46119a6f4bb2a8d7905558256b0d6f707d89801309acb004e3

SHA512
75a38ec91a0947ada50c6546ee359acfdaa5aa4ffcaec29f52ba6c98320376016e094f157adaacebebd67d4f8e6346f96f84ac3a1412a2e8bcc9c5933fc316d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
3f55db311e67f04267d1401dd146f0c1

SHA1
38c3fc168bba62a7c8cd85377576bb8fc0815d93

SHA256
344867b04d6a8f7384559c6181a12d37b8d686725893324e1763f852e348dfda

SHA512
f78f84da98917cd6c265316e3bdb994fdeca61e9e05d2ccb341d62a0ce3c964c8f150687e912268bf1fcba1fe65eef43ea1eac8603b5d1dc8aa55acfcdd3eba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5797ea.TMP

Filesize
204B

MD5
473f46865e7dd5a47a7495fe0af46010

SHA1
f39f37e885f3948f339aa7cca7d7385930b729b6

SHA256
555317336c22930c9543c606c2eda0508e7e3de33c23a91e8d52d08c8a762d5d

SHA512
22890951665bc0b7211f8043c918bed25b3181a67aaa6ed361949f6f634f494afc37b34612ac580b541adb32915380cdd5cb50154beb00575abc3c3da78972d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db1f1ecf3fe5f7cfe150c063af22f817

SHA1
d61ce81e9ae8b7a3540b4a06c373a881e62fed0d

SHA256
23d4b72f544440f3faee2969423f1fea60fdb8b560fb193a811a5392144fe48b

SHA512
5c1e418693d16346d9bd2a86006d64c662648df1938e8c6e48d48bdce1aa348d2faf92d1b85947134a19e2c2f566313d3ed94a29f92357c7e7527a3de131cbfb

Download Submit