hxxps://tribansil[.]solucoes-integrada[.]com/R093MDc29JhI[.]42M/ys195JJDJF4s32S7/kheimpquwgygrjybqkqbraGUfGxj3ovL6jdaIKlrprVFEIrhvmjrnmULIT/853391004025750360/Financeiro[.]SSqiJv0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tribansil.solucoes-integrada.com/R093MDc29JhI.42M/ys195JJDJF4s32S7/kheimpquwgygrjybqkqbraGUfGxj3ovL6jdaIKlrprVFEIrhvmjrnmULIT/853391004025750360/Financeiro.SSqiJv0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
2500	msedge.exe
2500	msedge.exe
4548	identity_helper.exe
4548	identity_helper.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1208	2500	msedge.exe	82
PID 2500 wrote to memory of 1208	2500	msedge.exe	82
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 2544	2500	msedge.exe	83
PID 2500 wrote to memory of 3216	2500	msedge.exe	84
PID 2500 wrote to memory of 3216	2500	msedge.exe	84
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85
PID 2500 wrote to memory of 4384	2500	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tribansil.solucoes-integrada.com/R093MDc29JhI.42M/ys195JJDJF4s32S7/kheimpquwgygrjybqkqbraGUfGxj3ovL6jdaIKlrprVFEIrhvmjrnmULIT/853391004025750360/Financeiro.SSqiJv0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffe189b46f8,0x7ffe189b4708,0x7ffe189b4718
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4834632043853800250,6179681972927275257,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
30KB

MD5
7811a0bdda11c384e5a7cdcb4443d202

SHA1
eaf3d0f16570ee1ede43214c4fa3323393e08aa2

SHA256
b099f6bbfedfbd7cb4cdfd7fb66112bd70365c06a76fbd2cf69b8a1bcf692599

SHA512
fbf07d31590da4c252ae65e48f15aa21ff1d000594eac8278203f714343cf4ffd373d88069623ab43ee1f55736d9d77180ea353c36bc7aef3b29f3ca83bda974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
938e7663f5aef64365892ca7bd3e08e9

SHA1
13f88561695ae6d62657cf80b35a4c1b76bf9fe6

SHA256
60fb15c6c23286feea9dfd694dbc481cc4ca1cf2cff0ea2b681c16df62b37e24

SHA512
a55cd398305217f7a65805ac86792fe57e4b41e9639dfa7c41e6368ebcd1ca4f3fda75436c9813e6ea7cd9bb3b69ab4d5a6b4fcd6c2a2bd29bacc18948a90747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
35KB

MD5
949293749ee6890254cbfb5af21a9b13

SHA1
e1ccf5e63f17474e948fa4ee5576eeb9cc4b54e6

SHA256
77c69b532ccb73d6ce5e877b1c7f61a4f3c23614c7e39bc7455320664fd20e89

SHA512
d8214e3de543fa1c576a6f681609683824d48b4b5d4e0beccc59523987131af6a62e0ddf0b69e48052ff612b0a55c4b02c6df2729490a5595f8f8a55982ba8ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6fa2febb07b0e37b9787c144e331a3fc

SHA1
c92cd34cd9ced9b68ac8034e914816f6bd3dcc0c

SHA256
512661353b1352c35b85819f18470e92049b20df195349a4adfffa9e2f02ee14

SHA512
b081ac6223863b90b3d6ab19d95a29a9383b603b70f2dca2b0b879a5dcf9a120913da7ed890d932d68beacf55ee3dbf6babe7859ada56bb20f8337877372aecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_sandpad.envs.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
270B

MD5
787d30578d021a46e1231daaa403f1d3

SHA1
cf4532ba6825e5210c20d42269556cb887561e92

SHA256
68a8e9d59349ab2a6ae962479402c96697c89ced37bce492fc00ce54d662d9db

SHA512
7529a4b560f46085ad085bd617056da84964b520d403eb932c10e22deaf80709d439ab06d9b5068c4f6fb7f384e9d956e9f72462eaaf9b92a7cc4a6ea7868e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
330e54f76279be7d4c90157a6ee1460e

SHA1
542b90b50d91cab0a112ce3ef60c30b9e852a7c1

SHA256
f113ff826ed026f154cb58e7464b24eac1123dc50dcb9efa9527fbafe8ad07b3

SHA512
fe8e37f3874957273f4f4f3a363effffde8628d73d79280034cde64fcd4e7ec215514a2b6901c11b2b5944def7f1a39b0c5eec76b44c498a99e3990a0f612eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94baa618f159432f41845e03965d00e6

SHA1
e777a276ce6f056e68a5a58e5a6f9ea624e7b4c7

SHA256
9a9b9aa6740ef1ae66316f29c73c5377b8dad773b96aae4a968db914ac42b49b

SHA512
621e8326597e998a82940da4bd489aa2036ed47d66a742a9b53f26a9adc84aa323361ceeba791f1b9c06578d06449290a6400f006aae492e05d41a267a805d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
d2400a55ad6e225ab9aaeadffef5b6b6

SHA1
49652493c405355a5179e8e61b7bc1a0163c2f25

SHA256
b099ba5a1937986abcbc36f403dbea6c2d8dfc64000b04587298ef83777075af

SHA512
f3a2f931fd73a3ee824401aa4be6e3dec4daafb54bf5590df95bb93cc7c228d3502c8686ded7ae9ba2013177010822c095b97797738de16d9af89b387f7a0dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
8c2b09a4f96c775689b985be409f376c

SHA1
2f29721cbd452e7fc0dda09a68efbd2375a4c932

SHA256
3dbdb7b93b6a7051bf259652cacddbb68ed83210c70459f8722e1577721d9c62

SHA512
2e2454da13bcd2b297820091f739aeac8fbe1e39a585b2188d325bfd4669bdafa96b4ebfb3c43837bf6c0a1d5d2e13a9a2e23bd374727a2c0ad623588850e912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
09313cc181395101b631a564dcf35415

SHA1
2f0c40b984d32b9438c3b132adbd76739fe519e2

SHA256
45e3e47d9bbaf18b9c34e01fa531fa08e123abbac2ae5620bb64aaa235b3665b

SHA512
b47e6348b1d7ae1d717490c8c1bd78391f6c05da120c9e6a82aef690fc1e49ce4b2956bd71a21bbf0e4eee864a5a936b2668f001940c482d37b02aa18b6d882d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
c788884e1e7c1a7cb98733c38d6b4264

SHA1
573828f8a038f819ced54517c90ffc047b88abd5

SHA256
58970035c998f709d321bf44a2e4f6a4620a83e27fa3f7bcd79c29759267049a

SHA512
6ea6c4e25aee1873309fe1751461b89ffa8047a85e7405e687987d3bd0c32df0d7f729476f62fdd351bed866bef0ca464a265d9595d0b42b9b93ef1e81079f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a057.TMP

Filesize
368B

MD5
9e6763b1837e27fcc6a9166be724a2b4

SHA1
29bf88b57a1f9b32e2ba07e8482e0891a392aa88

SHA256
625202eb04d6b31ab9cbe0e9a68466313cef601106501bd55a50307903112cf7

SHA512
699c2365e23f07d1a2aeb87bac76c74cc0573674d7d944e2e398aab1e0730972ada6e21d3047a3d3b75d4c710d2cb9933591b85bb7c855c243dd876b70a56de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d756fb0008a1d71331008f6ae4e1093

SHA1
d850834da58bc2375f3101dee27d48bb388668d4

SHA256
57f10728d9ba68f353046324be22fd4d72e746bb911a180c5fa0620de0bad1f1

SHA512
0c21711d7be3b13b06c65daa41c5d7070a9fb53cc8b8b7a172023a2cde2d2f7dd9fc29a6479ede713008e3fc53208f22e76c521b5470148d3ccec254b302cd18

Download Submit