hxxps://url[.]us[.]m[.]mimecastprotect[.]com/s/cx8SC1wzv7cE88KR1TLKc_a?domain=airtable[.]com

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
24/05/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url.us.m.mimecastprotect.com/s/cx8SC1wzv7cE88KR1TLKc_a?domain=airtable.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
3716	msedge.exe
3716	msedge.exe
3316	msedge.exe
3316	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3692	3716	msedge.exe	77
PID 3716 wrote to memory of 3692	3716	msedge.exe	77
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4000	3716	msedge.exe	78
PID 3716 wrote to memory of 4032	3716	msedge.exe	79
PID 3716 wrote to memory of 4032	3716	msedge.exe	79
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80
PID 3716 wrote to memory of 1956	3716	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.us.m.mimecastprotect.com/s/cx8SC1wzv7cE88KR1TLKc_a?domain=airtable.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd156c3cb8,0x7ffd156c3cc8,0x7ffd156c3cd8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16725714322983773950,7462696091920228015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c1ff86f4c679667049ebfa47d66961d8

SHA1
58b44ae3bd3292f9644f51208925e6b85fc60f83

SHA256
d4444b3e192892320f305171b741ebf3e465b50e704303e7cda1b3855c72ba6b

SHA512
f3af5970055a40e2fccc5efcf866a52f1a946a2b5d9b1f2ff2d29eda95d7768aacef87f6f3a51ba6c9191387f124e07f921cfcbf736bec70e0e2709ad21f9d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
625B

MD5
79475d3cb62e9188b5e777acbe289edb

SHA1
2f2401c51647afc3c6ea266fa9a97a0567eed65f

SHA256
434bab589a549157c3bfa3945ad76fbe28021dd19087ef8d1813fab3a75108aa

SHA512
1baddcb1ded9fb290a1b23bdf245bd673e8433b65dadb58a80b60a1715aee4023e6b7194c9d18e4765555cd62a378b7b0fcb595cc14fa4673318ae80c11702b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
508d0fbcfe71f4e66ba8ceb594835ea1

SHA1
359bda6a7b82813c3282fdddb8172c147a7ffa9d

SHA256
887a2cdd206e53b73d0771e7321552ed409248c1377e42e4a2da9631fe2e86b4

SHA512
92d23691a202d5790cda0f24cf8127bfb2d8fef800a70b8e0fd46c973ec24f0e085606753bf23b23eeccb77677b3418f539ad289259ced55474b330f1bb5974d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edfd71bbe8676f4dc2d4fbdef3ca708d

SHA1
5bc118d9b3eda076ea2895b36b66603b5f1c8e4b

SHA256
3c124cbb9149b268321be04b982dd13da88f7bf1e03442f6e74af37b382ac838

SHA512
0fa8c488474de67b437682be02eb4da7d103f59030eb1028650686db723761aaf11b23a77ed33f77e530fb66460367631cc6dfab8f65b38595122cde1374d36d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f7400eda6fd7754f825bd3ea510fd4c

SHA1
73888763abcfc225325f9b82bb50b3cbb10e9420

SHA256
0fee512adb7f59c27c9f5d372a850767e675d078a167815a9bd90b1a435178d1

SHA512
9822e6d4a7a82025b9f7e787adb9efa1980242659214b6c527b665e970608a94542ec90ade6d6369f44323ae6af3c32c7ecd8137cca39febdb0f3944ee79091f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cc27952d7c21e95a6299ca62f28668d5

SHA1
9e27560aa60587557e5cc66f45e719f4d48ef293

SHA256
9de83fe0f00be5c569ee4ae33573f27081bdbb0e07126a791228bc4d967d38c8

SHA512
e151f8f48ec507d551e6ecc73694eb8243fc3dec970161e9c3aadaf7297d3bb0800edc583d27cc45dcd9806b886ad3f21f4a17f3f03ff4b538bb700f044e9b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a2847b25593a28b8951951be04c1184

SHA1
e01fae2ab4135284fbfafe99055c7edb674d5c97

SHA256
8ebcdb6c8d6fb422e9570dbdfe7ec3bfb880450c53fc419c92fde665ff4e3892

SHA512
210a0dfd072b9a6956f91fb3146cf159e5d29418807d6421bf97793783b09ec6b58dc70c25d1a0c287163de2c5ff54d9a65e541c7cd0bfcc8ac7ad28ab66c565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cdcbfd70c09e37be1405c37d864a4f40

SHA1
883b5ffe8368238ddeb41972814e201d7d33cd99

SHA256
413b4aaea67aba6072671f7ae120865f6250059f075b455da1ceb878df606498

SHA512
0b5fa757ad5b8a666830d9a437a0308b3e9d8b6448285681653f3fbc1622355688aba46b68d6e86cc28f81e5134e84fdc14259fd30ee0ff9b38170dc92a9ea13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c525.TMP

Filesize
702B

MD5
d49a863c226dfca5898d1f4e3f86f308

SHA1
d5b7902244e8b8e9cfa50f76668d5da9a22949c5

SHA256
cad3175387a6a506ae6a4e3b4741d516feadb7956253cf6c628e1f06c2e083be

SHA512
5645f5e03a9f0a498f096bd6e244550dbdc1924d745c34f23de4fce20b2008c997461e19902a8d22c52211cc9cfef85d0584fc4d0d421f79045eb0c687aea831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
527d7ff8ab339c7f1857e60e8fe3cb21

SHA1
d126d7568f23c8dba6e357f4241011592d81a4f8

SHA256
c2b1b9af499f2ff91f6a8e286d56d597ad1752d96301dcf5300789b9b82f2af1

SHA512
01b8ca995f14e3ab50c358859308162b0a34f85e793eadc62a13779b8c7189359f0e7c75a46bfef12ab02809443aba30769295322a387ca96564064b4a655025

Download Submit