hxxps://edworking[.]com/share/workspace/clw51tkc20e1jhfwlylweomvh

Resubmissions

14-05-2024 15:32

240514-symvdsda58 1

14-05-2024 15:29

240514-swwdrace9z 1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://edworking.com/share/workspace/clw51tkc20e1jhfwlylweomvh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
1664	msedge.exe
1664	msedge.exe
1276	identity_helper.exe
1276	identity_helper.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4152	1664	msedge.exe	81
PID 1664 wrote to memory of 4152	1664	msedge.exe	81
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 1064	1664	msedge.exe	82
PID 1664 wrote to memory of 4656	1664	msedge.exe	83
PID 1664 wrote to memory of 4656	1664	msedge.exe	83
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84
PID 1664 wrote to memory of 2688	1664	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://edworking.com/share/workspace/clw51tkc20e1jhfwlylweomvh
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe676e46f8,0x7ffe676e4708,0x7ffe676e4718
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16358945508494259188,545886141044261793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x530
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
b2ec2f07116248029833d5f9eb1666fc

SHA1
073f8adea694f6d2e0923b005dad10794a41b825

SHA256
5846daf35176c9b4f47fc4428086cd7adda2176b314077bb50191067e4ef7137

SHA512
27e01a1de0f23f36f9cd4ec718fe56172927f5dbcb53bee5890ef38b694d835c6a965269de28df2a09b02468111b7c97660f5186aa427da59b2a20a3e3158b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
90c7515309634cc12f41a621b9ff4d3c

SHA1
998822feecf86b8caee5a4dad2b9eb732aeb2bde

SHA256
67d0c045fbd90fe6d144951d1f9f6bf90a12dbc03e8abd0182ca8bada052b98b

SHA512
34dc7797b28a6581cb347de4982f7c282d00fcc15d3cd0750508d0f4f9bd0cc7fe746a480c732c7515e1146e927b4576f92450e41e4726c087279d8bb9e5da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
78082416fd9624d95a1168c3733e76c2

SHA1
0ab48f1746ce540bd52928c312ce517cc51ca955

SHA256
caf1e4e53d193db009d62f21ff23ccf8d1c3826500820253f3c51a283ddbf0c4

SHA512
c0e7144b3d20a994be65e55b2251b830a245b5c0b0b9779d59635794be2432d3f019ad7e0258bdc20958dce0755e6d02285f0c3a92ffb8c258039ffd98ac65af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69a8d791a833df3a961df2d473c238d0

SHA1
b66f6dabf4d573e91c6a8fc6e92b27aa241fec2e

SHA256
57e9f17b986363ea18d2cdef77b58603ad772e87a412e597e7e8ec7c00f1a2ca

SHA512
b59818f41f3498b1d637e14e03bced837b030aaddf630ede566c7fb15afa7065c1be6ce86a8afdb2002ecf703832376e105d22c231081527264ace656636084f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
02d7413502a514601415d1fbfc73b85f

SHA1
6e682f2b0808b2abfafd716d373388914acac27f

SHA256
2b68563d37e49f8a887467083611e0eda4598d87e2d1c9bad486050142b11576

SHA512
15d66d94845bc213f3a681678bd212d854dd9c6ba3f6e2d889f96bf0ba76dc7a5782175d8d0f10d2b69153a0deecc08d3ce8d226fc1cec87bc0d31c10de2fe30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c9771c386faf2f3a453d17e5190a6bce

SHA1
b742e3b4fa5daed53f08214f87c9380910668a59

SHA256
4868fb25a547c888b6e6f418d658efc4117018cf335862cdefc83b9efc9d6ecc

SHA512
e6c636fe1967078ad1d7fc3c9833be4941771b0f67d423fad5ceb05ad749f91833e687567d8757e50e0036519aa1ab99a11d83cbd6d7060864ce10a356d82eea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ae41.TMP

Filesize
1KB

MD5
4ad2bd35a3be31cc4f01d50d8a740445

SHA1
c1c2ed5990ef03f01188651c06ef6a806f741f5a

SHA256
920f3e53227ad722c84475b3d297400e71aee19b7ed3ff9253cf231ec05469d7

SHA512
62dd78e3e12e44f4c3460d0e825945b974fd3ff5bbc800f9028e763b7ad27c19303b933c09bf4a984f1b9a0f1653cf1543d62017d86195e3ad7247bab85e5344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7136696c36e4fd5335821724dfb630cf

SHA1
336cfba9b68f9538faf37fe6a05400b4c9786672

SHA256
9c032ef7ce3aff4e847435444c1abd4d68f450c6eaa02bd91aaf35eff686932b

SHA512
55d26aabbf84642db450674e9ab600f08507814e4744a32d990d5f6bcec4f24ae3faea587c5bb11d5c0f2d460987c42350d43f1bfe893bb8bc6eb235ce267e35

Download Submit