hxxps://calendly[.]com/texas-retirement/retirement-meeting?utm_source=yamm-sam&utm_medium=mm&utm_campaign=YS0129&utm_content=YST4

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://calendly.com/texas-retirement/retirement-meeting?utm_source=yamm-sam&utm_medium=mm&utm_campaign=YS0129&utm_content=YST4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
3216	msedge.exe
3216	msedge.exe
1800	identity_helper.exe
1800	identity_helper.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4128	3216	msedge.exe	82
PID 3216 wrote to memory of 4128	3216	msedge.exe	82
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 1040	3216	msedge.exe	83
PID 3216 wrote to memory of 2224	3216	msedge.exe	84
PID 3216 wrote to memory of 2224	3216	msedge.exe	84
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85
PID 3216 wrote to memory of 2352	3216	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://calendly.com/texas-retirement/retirement-meeting?utm_source=yamm-sam&utm_medium=mm&utm_campaign=YS0129&utm_content=YST4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc502e46f8,0x7ffc502e4708,0x7ffc502e4718
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6850567051424338335,2510554338305128980,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
26e3efa9926e75060948013ac11f573e

SHA1
1bceeb46d4291a2467d4e18fd7579f64467a770a

SHA256
a6abf5645743f1d9297579f6c4d4e59cb57ac5145d90ddb310481321e7572fdc

SHA512
e6b6cec948d4f51fa22522f3061842b710fb7f4c25165627e427173cd61ac79cd21a3cf7605abc4fe72900d5ff0a9d6f20ea8ee706b355dbc576cb0f939d9f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8d79cd25f135e25ea8ab536b75efc1ee

SHA1
adb282732712cabd5e02a108005330da92918f59

SHA256
368ecc12e6c9ade5d04d6cc51960e460323f6279e441b721f8fe6dc1db45a1fb

SHA512
e6fa7fa9e5cbf05b9c03b7cad9955f9b87ec0fc89af27631ac8c92837efbecdffc748645148a36ed0d866475918f20c98c4f49fb1d57e1ce58acabc830c77f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fce7b7daa358a8e51d635d9d4952f728

SHA1
be31f7378d122a17dd6c7db5b17b6dddde19b6fb

SHA256
ccc6d10c60cda5e2661a077d7f147d5b5de953439db2a7eb90e3c167924cb385

SHA512
db7dfee9425107aaecb8451085ada7d29f2e9030daae339fa1c1ce2385ccb05d77daeb08abe491a1f4a9f627070fe79bc8fc339c0bab58ee3f2d1ea975f0a107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
262e0889e798be04752f911e4c3688ab

SHA1
0367b08f23065de17affe2435c42b924cb098028

SHA256
9f14ad6548599ff7965f5dfffc02216a64b419f367c6320254ee57caf6ff4958

SHA512
c6bff0974b64c8355b449002cf1dd653d74ba5057cb6f28747929e4b90fc6cc42fdac73fd0bc795e4f4861f971f720fad048e74829491d44d7111fb4c82faf65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24742abf252c302ef771130770ca9518

SHA1
b2403e3b272a97cfaebba75aafa588b880a9fe51

SHA256
611b7f15f363a1f248807fc0db194f8cf2ad08071d76d371fa82ac0a4b4c8f4c

SHA512
27bd38b104a12e2dad62189945bd1b8ba40f22b171617488d8200902f4a064e0c25833574b211008a9c21d344a34e1e864a347a3fc9b1035bfc875f174c011fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ea66ae95a4f8144cf3993a6cef95200b

SHA1
6acd224ef95d8d4317bf19206af96aa0bf01d0a0

SHA256
5d9fa3b19aeedd5b56510ed3d28cc2ab61a3ee78f3071dfcffeedf9c9762909b

SHA512
c39a10ae4a6b280d05b676abc3a2e2b1696fd1f4ccd42269962b90eb4b26b9c15ff817032aa4b0aefa046712ca4c9f66c35f6f928a3c99a31d45d743b2994271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e6ba00ff279828128bca1a9592ce75f

SHA1
e66b35227766f9d97ce6992ffbfdab8000a19506

SHA256
893bbfd0decd75f8a41d652379293a011acb5799704b6860b3f334c56cfb269c

SHA512
a59c9de916bed781c962977a1863af4047b2847a95f39cb33a4fc3cf2d18631bc5aba0dedb403d51966d5e3aa3d167d30eae28b08630ec127aad6c0a21bf5307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5899e9.TMP

Filesize
1KB

MD5
5235b0207d5f8b3db2593c9dbd55ccae

SHA1
bfd541a4ea177efa9832e299c4b04909b0bdda31

SHA256
afc786331eaa280cde79da13a8b448eaf6ff981cd6fa014b3568c142110d81a1

SHA512
f850e58646302df2f91c48ed15a0b574d667dd397d00e4d49225d46f23117274fd6c026cc26a143da53cf752dc08696248caddfeb65f00e6896ca4207c6fc1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9278d490be25cf9c868beb779068a6c8

SHA1
a6b625ccbdacf880d26adb51a2babf0bcb4d55ac

SHA256
0fb3df20335a7bf6255d31861a0d0c4785c7e19a871dfcdd0445e175ecdf0859

SHA512
f97605d6dd3cc58cb49016bcd7f91545220a11d9cad26556cfc42c43ebf0e20d65d72f6601205e9558dfd301bb3b21329338fc0fd14d7f659a463f9f02f6b391

Download Submit