hxxps://www[.]google[.]com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=

Analysis

max time kernel
55s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5424	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
4952	msedge.exe
4952	msedge.exe
332	msedge.exe
332	msedge.exe
3012	identity_helper.exe
3012	identity_helper.exe
4772	msedge.exe
4772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 536	4952	msedge.exe	88
PID 4952 wrote to memory of 536	4952	msedge.exe	88
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 1168	4952	msedge.exe	89
PID 4952 wrote to memory of 2952	4952	msedge.exe	90
PID 4952 wrote to memory of 2952	4952	msedge.exe	90
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91
PID 4952 wrote to memory of 3548	4952	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd04646f8,0x7ffcd0464708,0x7ffcd0464718
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1212
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\f.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,8558566535450146012,9388132856083846037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\f (1).txt
  2⤵
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
393B

MD5
fa9f32e997f9111c25301d66efb28962

SHA1
c6cabc05d0392e746276c6e86f36661487e26494

SHA256
5d26cd9517ce158618ede8bd5d0713bf819c66e49bc2f4095a2a9aa0072fbae2

SHA512
b7469bb8509699008902cd8d64912d4baf27ad9bbe3b7b1c7f495cca0263af496f1b44d9b1fa7a42516010c3c450ca2ccae84e5d2ba306224660daa616bddab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f626ce606ea41410df49fd52f21b4b0c

SHA1
094777fe04e41624789793092eb110d60e0fed91

SHA256
1678643bcb467fd5e17ddfa6d637a913673a265651dcf72847f0849f19743203

SHA512
56d8a150fbc1c110fb5946b14f92859bdfbe1070ce85a057b9a9c5d43e9d72f2ea51587260a787dbe7ff7c23ef3380671d433a0b406ddf86efc2131b75523c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dc83931fb4b1306bced6040377cfc2f

SHA1
c5dc8eb31b93631d33b6023e0caafafd90615797

SHA256
bde30b12e01d43a42ed60ed234576a2081df1325c8c0cb9773300d85888b43bc

SHA512
16250f05bdc6f376a5d769024acd349ae52967544c8100480a3d057b580300c86db2aa33f99245927873f2027d65a75633b5e38b08e342796dc6a5e2a03d71ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f2541997cca23ba84a1228cf66458ef

SHA1
c7d64da2d753bc84b603a0cd1a27aff932387258

SHA256
3f96dfd0451eba0788275279f82c4d82cac8b5ba6bfaf6ff2a723269686caa77

SHA512
c90134075aa3a4962b2a4a0f3d701eaf4b3f82ec7e57c6e2cbe9c4fe354c11a09104a4508ab1975be6c286fc453a40dfbac79eab78afaca4531225964da55867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed9570bf6707be3f9faccb417050b35e

SHA1
dc1dc620c2059a83c9235ab7cd9762a50aaf091f

SHA256
89210662bcf6c9e677a3258fb4ba168477fee61b76b07fba916327a588b7e934

SHA512
b7c39f46847732dcc071b9b8f61a4cc753843418939fab763b123e94725f52c78f3f63dfd4ab294256e1b664b0a9cd89b1bf269fa2a577aeed2f803cf1925ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
85ce23b18ff5104b5d7da96b14c110ba

SHA1
f86883decf901b325631bd97484373f5cd9d6bd4

SHA256
4e486739f3ce24b9483b729ceb6aa6fb5bee5ef7a524a6f4290190bb2f66b693

SHA512
c7f8a21190902229b089f5dfe3050397da9acdebba4286c958adc18433ef8256b6d105762b8da7e17f68f853b40e41f91460ea945d15294854ffd4322f848c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581057.TMP

Filesize
204B

MD5
45f4bf78565f4c6ca7d9d38652d01f2d

SHA1
bbfeb85e7071d20327c5a978d64d07bd6cd33dff

SHA256
0a75f2ea352aa5dab605979676551df3d1bd3a1c8a32bf056b48b7d9d9bcbdf5

SHA512
6d30898fd15d5542c9bce90edeede7795e668a504b874cc25aff32725f5ea7a1a4c355c74ad3be0ae5c83b35765b3907334ca5021a4b6dea3109b5b384245a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1613a5ae07ec38ba563764d9105203d1

SHA1
fe9c856529b1484c677b287b02ed1666583d4de6

SHA256
cd2c88fbd8880961a51fa1508e71464566f1ee6418924fd056dd2fad04cc2860

SHA512
81e5ba037b8e8f52693e540e6281e1026f71404e96ecd0f15f11e9721f3b241ca9cb3ff605a44f12b5e88a295b5e9518f92220fb71213494290dd697a8efb6f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a1430191a099a53983155ba99193aa6

SHA1
4c04cabc3492f5a8aaa373cf2d3b1f05ed00139b

SHA256
e5f1df351896937ef60c34b277de9e40777ed3dc7046b0e92d821f40a882c52b

SHA512
3736e47e00526213bb32fab9c6073e3ae2f671d7834851730a9d0c525ce2d7cd89936256b0d45a26ee13d137813337979efadbcdd87a826ecb6b251dcd80f97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1567936cf70e7f10ab8c69fa2ccaa12

SHA1
e6e2eb3dd1764dbb92aa6d4467b9a584eb4b6641

SHA256
101d363ce3cc52c476a0ed6a7e63c4edcfdde2079a7d99bef33457b9e6da1417

SHA512
65827ca30a3a5c346bcb8e26b663272305a7259c7b75a24a8e12112b05522071471932b37f83ae5b5b68b351082298e7850dfbf8f363b949877b5777f6bcdbe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d73fc744b02f06d9aa70ee92fa5d7280

SHA1
98fc3225529527e8207ced8c5bd77593142c9ab8

SHA256
7d758ce881cdd170c41234ee36352348e402285dc941e675503fb24262f7ed3f

SHA512
8b5236952474b81ce66581421657bf6de214372eca58a396ea0ca6904103cdef3a8ec65635e8146bc19103b8f3ecf68185414000b7ccf1362c1e287344a8cd8c

Download Submit
C:\Users\Admin\Downloads\f.txt

Filesize
121B

MD5
177a6d16a9d70dc537a1d481aea41ab5

SHA1
8c86a0e04654604afae7217e745faf33421be236

SHA256
e6b6bc6bc162fcea2d575f3565c0d085f47b22a3c1926244504f9b5ba83607ab

SHA512
c69e1a492c4098fb5b0fe565c26d94ce9d5a65b14906a820cf840fe470dd1cce3aa62d29083d5edd205343c84861a61d9a24bbbb4925defc832ea1053c04e77b

Download Submit