hxxps://smartproof[.]kwglobal[.]com/smartproof/common/home/907a4ba19ceb/Author/OP

Analysis

max time kernel
74s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://smartproof.kwglobal.com/smartproof/common/home/907a4ba19ceb/Author/OP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
4940	msedge.exe
4940	msedge.exe
3536	identity_helper.exe
3536	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1568	4940	msedge.exe	85
PID 4940 wrote to memory of 1568	4940	msedge.exe	85
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 4120	4940	msedge.exe	86
PID 4940 wrote to memory of 404	4940	msedge.exe	87
PID 4940 wrote to memory of 404	4940	msedge.exe	87
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88
PID 4940 wrote to memory of 4468	4940	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://smartproof.kwglobal.com/smartproof/common/home/907a4ba19ceb/Author/OP
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff97d946f8,0x7fff97d94708,0x7fff97d94718
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18312652677228490117,14157084150000361239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
110KB

MD5
44006c522cd7d5e65d1e992ea81f1f7c

SHA1
fc65b2550d9188110c5e488b1379ed3e63e5b85b

SHA256
a6a926fd31ae7252a5bd7785c03ef8d87243d87c446ed657c00426f8ea252e8e

SHA512
784e7c8cfadc25f81598651f72eff6d97fd12e193e02d662dae6ff635158abbbad9bf88d04121693e630766a8262e13dd02fb8b22497029f3264f6dc3fd714d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
111KB

MD5
c60e1c661d322f45bca4b96900041dda

SHA1
a0c90468492883c2dc67e268a6ac675af41e88d7

SHA256
ab1244a7c4bad7f3ddd49b34faf216b3209c717f80980ecc1492d9dab49e7882

SHA512
0bb501fcfb18325c3f35bd8c60f57e6e646dbb8a13fd399f72655066dd9abee4caf407096f72d9a6b56b46cdf1e40830077f1186975f148cf4d0e4ff1b88d82d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
110KB

MD5
4d735e2b0a5c2f34662a92ac68985cbc

SHA1
df589d88e01d42ba8795b54fb7ff371349d9a9e1

SHA256
b2d161662ee2f436212d4b39d0c09207216d0088ca6e0cfaee75cb4472795899

SHA512
94d04bf9c2161a71b2c8e624b029bf245c996d58aeca333511fb57e0780039986e3d9fb19a3f36e15068036b3c014d1faf21d29f2825bea110993a9fd60fb698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0d867531ce994d52781159ce53e58862

SHA1
b1175a1cdb7df48dd328516063a9df7df2bd7ecf

SHA256
faa9d24241a3d6a416797fdb48c6ebf456ddbef6d0ba187d339061b95f2dcd50

SHA512
32aa981eb36d916f8b20fca3404349cb109c8baba3620f1953d5ec7f57ceb15d8e466fafea89f5a046f5794b7281747345dd32aedb2a758108fe964404c849b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
422B

MD5
2b2c1d6c79398db049eee57fe651a683

SHA1
0b4a60ea97fa9a7221ac387aa6cdffd1e1e8eab1

SHA256
45f6dd86488f4c7793769f3d019ca48ff782f97199e3a41ff82a08ab0a016df1

SHA512
66fdb11fc59c9fa010d2583778a484e93ebd771763c57d017137c942f55352c50fefd354aea813dc5219e67eaf9f65f31d2432668163f195b0c3af804d9a7fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a452f5cee4bd3e2c025e84caeee1faab

SHA1
5bdf7ad7a9dea80db5db1523c4ccd906f8e4ee06

SHA256
09e1537901305001988902b4d6fadcb1ff381c20a25884fecda5349bf8647ba4

SHA512
64bb4ea53793261af0748c540ced8eb475d2ee76b8d2f2ea787b92e42819919e52b95bafe1509a67094750f55d8c10b6b936876cc16fd79d70611b7467060a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0d95f80356a6585b40c6e9521a5cb6b

SHA1
7a9ba6aaaa370e36b6fc66f34d3b18c7c18be578

SHA256
5decb7a5b594c5c600a2eb41367669236b6851f991d3ddb53e1b0be4b315c548

SHA512
59a6517a29ddde7e021c000ec125297fa1fd5f9b2557b12dff77a6018ccef47de81183725a8aa07c13fbdf92df5e4d7d097de645e573b8dd75ed8678ab39fbc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87d7e35490b0cb3afd89ed9a16e20554

SHA1
8f48e4169deb6ceb478a0c3bb37e2f4ece019ab9

SHA256
23e54abae6a3ed44f0802594eea4f59574c40615dde905b370af46f5ec911a34

SHA512
1edee50d90b207390e693ebcf9e83799c2b569ed1083c085e91cfeecd8f3d32c06de410fece51449f6d8003493c5256249a2120ece717dec6cecc1da33f52dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96513e0cd196e57d62fcd392d33803c4

SHA1
6d2ecc2455d6ea3cf26f3b97be5f122889214de4

SHA256
b8db4341f4694367d29336669e1316ec4726c2333e83a98b2077408879070df4

SHA512
9bb8c2283630a9b2ea2d9dd7c144482e8a13f60bbabb811d53f0703d80fb59f3e52b52f2ac42f018006307ddafdb5d988c6ea64ce83e0bdcc23116898f59c9ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
5ac985ce7210116054c21f19ddabeee8

SHA1
9af62f29020ccb876eca488c025983226d19e38c

SHA256
521a6cc217a954f4b936a907f84f5aa8c13de378d4ff8231444ecc32ee3b607c

SHA512
2dc5a447a646d75ca547ff69de819d2cce701d2ffb4d4982684b732a30f729105f82e4b3eba1f2c009bd55924cea376d594e1b24a0114536256d196240720dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8594963c91ac7e80eee6f4ad14641a04

SHA1
0c2c22a5e44401728501d5d4ed6bc19e8e724523

SHA256
576dbc60f8b1ab82b1e05bd21e16371d742015688e7e3f51d4198473bd4f370b

SHA512
21e080b200c8dbb470ce253a67f1b72b6af17014b22d680b55425d7a4c260225e442e3cae69f7891f94681930fb70b4bd6a870e17c75bbcede3e35880119949f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e0163c842d0ea2b147d96df8806d235d

SHA1
11e2ca0a08161252c1216f6fb1eb80278a22f642

SHA256
929a78095ad201a605b657bd808812dc4d7aad464159c04a4cacb063d96f78e6

SHA512
b137a045f8813d28297d08e9435a8e78dc0cd20e80687ea1fa520e9e5059f86a1a5a4b1c00089751012df331a391cfdf799693aa53f6fbee5bf7394eb87a26a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f06b.TMP

Filesize
203B

MD5
a9def2de9a06b298b49b132e5ed4f105

SHA1
6b70f16e02f5105d4a198cd62d660d161a432075

SHA256
5a7da6430fa543d194269f7074acdfc5cd30b2de77e1462694a407a304dedfe9

SHA512
da04a223dc3aa9e1096a0d786afc9c8ef4940461902777564311a62a7d2e7a39333b582f5d153be0813570e4946832210329d2ab9945862efbd282ec5c515138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
836f6f4bd0671808d06e737ffdc434ab

SHA1
bbfb46b60d8b2e9d5d846b71ab623f487085e706

SHA256
df40571ff0c10d8ef227c5a74479df9ff8e870ce04dd2879d1475962b4090191

SHA512
30b49e36eb5be5762d0fe602a9ba629059398dc16de77c2c9433cbcd906951b5e73cb4282bb9e9e9fe162780ea19249f5e69d1e2635838dcbf183c664ed7e3d7

Download Submit