hxxp://e-resumen[.]icbc[.]com[.]ar/mailtrack3/server/redirect[.]php?user=505232&email=5393&cid=aa5b05c468f1b43mail&url=hxxps://url[.]us[.]m[.]mimecastprotect[.]com/s/CAk6CNkn4ZcqoYz2UmJZFI

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://e-resumen.icbc.com.ar/mailtrack3/server/redirect.php?user=505232&email=5393&cid=aa5b05c468f1b43mail&url=https://url.us.m.mimecastprotect.com/s/CAk6CNkn4ZcqoYz2UmJZFI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1264	msedge.exe
1264	msedge.exe
1880	identity_helper.exe
1880	identity_helper.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3404	1264	msedge.exe	82
PID 1264 wrote to memory of 3404	1264	msedge.exe	82
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 3864	1264	msedge.exe	84
PID 1264 wrote to memory of 1576	1264	msedge.exe	85
PID 1264 wrote to memory of 1576	1264	msedge.exe	85
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86
PID 1264 wrote to memory of 4680	1264	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://e-resumen.icbc.com.ar/mailtrack3/server/redirect.php?user=505232&email=5393&cid=aa5b05c468f1b43mail&url=https://url.us.m.mimecastprotect.com/s/CAk6CNkn4ZcqoYz2UmJZFI
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd90b646f8,0x7ffd90b64708,0x7ffd90b64718
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16935346743263147960,14782886881253743750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
41KB

MD5
faaa4c6133adfd3801cbb6395d23433b

SHA1
2cf22146e81f38a939b8ea78a908768307822eb0

SHA256
99b4a15efe5db0385cf42400473522507b7d691d15bd3ca135523d153a9fff86

SHA512
e8fd8362d50f6279e81f2b3e3429bf68e094e9912fc5411b851300173781f220b87f26ea6459b152633e82aea29a0eeea5d95fb33fc5a2b71f4f1c0703f5b56b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e7aa0c41af93fcbbb8b64d88123953d0

SHA1
586e37105caaa334160ea7ba3096d79fd0cc53c4

SHA256
f1d8c0686fc20662cd93d608ad65c67ca12f20306123a2692925a5ea1a254172

SHA512
2589bd945342eb096feb6cec07812ae2d4bf7e7b6ed91da3ba685532c3d7778e91e4fb6c903374a4c4ba732356dd610703fa33dd6a85e0df77db42a91a9ad90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b9f9be785a4aee9f1297d571036147f9

SHA1
b7c1df5631d63459d8690b715fde85882859a62b

SHA256
21ffa5b6a0ea92e995100d947c7b71cfe70b8a4c63f9bac55b78b67907153874

SHA512
db725240d07e49bc6756677e208d6108a8f4f9a7ae59ec4ecc715ba3bb0d99fd099b63b304a336a80e31500a1c6fc404c516ac5fbd4a5ff4feed836f97223fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4232c4cda53209b3a731587a7914e28

SHA1
938eff4fbf3e240f6a3f5b40b55f812a1e0c5392

SHA256
82b84f98b7353f6ee0807ddc336ca31e52646f0c76b812f0b9db68779e986c90

SHA512
b5d5249dfb07cec33a2e0e8e3315590101a33afa288320dd937c978fb6e889c381165693ec77e04043236afe43ea03535c9ced782a85560d412b0fd3faf75713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ed25b84d451882e5c817b4a89e284b4f

SHA1
3bd50cc1d75368c4332566b2b64c91a64fca4fbb

SHA256
9c9d611fbbc6795989e7adf992b9cfa501937f20ec6b6bb2631be518d131c998

SHA512
3d4c12443b96d9e47788c34afdee8fc65a68937bfb3bc36dd375fcebc335e9145ec73cdc86cedc27ac2277b3ffe46314e983701375fb4018b71d99abc3f8aec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bb7bc88c773dc3e422f4342789827c0

SHA1
25b66d55cae8c299b007107a8659c2a8124926c3

SHA256
b9a244e10b6dceefde8c5e1c0e0f4e87d50a89001da29447db17c528814b9a09

SHA512
c9b731bf28a51f18dd4916c1fcb2d07531b5e2a45db9a7d1d6f9a6d9693a3813c878e2953002e9e150561591fb5040780bf7785abb79a925d0a31723a7032367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c42f21b4446e4c0f147675d2cf0ead0f

SHA1
3fe73da06ffbf7f60b6ffa34beb38f1ac74dc5d6

SHA256
308dccebdbe87aed4cde2278101f8b711d9e5c7cf4d6ba8f9efcbe0840cb50fb

SHA512
06270cacbef2e7d089bbf81f94d2bd172e7061af0f8e800e3fb2e617972e613ff04cd1ff4d76269f5460d6119bffea086d6a0a2a79642a3bb78e1934d66b41a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4053a210d559bdcb0d16c7d6a53242a3

SHA1
7132ae904b15217f4444a144202532f70968d5d7

SHA256
188d2320d26f1c77222c05b3ef34b53cd1a5a9a4a6c6a714222cef25b674e387

SHA512
ca2c2d0b13cc1a91b03ddfcda00f728c6c70de5743a3079d4da241892ef5b2d477ef335929d8e97763770a2f20e1f0b162bf9f05c936aedc2bd082cfde12bfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b7bccd06b006a78f918f2f022bb4a012

SHA1
b2a1a7cf8e2bd2758c3ebcf789709dae1664425c

SHA256
ab030e794b49fa85998d78612012130174a19767533b38294a84a6b718058b09

SHA512
8cb693d3648625d1ffcf01aa1332e7f55dcb58d2b5234eb08bb4efb1491024f837f0927ec55c98ffabfef24b595c56051d94ab7672572ffe67fcdd1f349ac143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
610a99cbfc12012ae0de0374389e42f7

SHA1
d323679270bc68409f07186255b34766d48dbea6

SHA256
d7873ac8e73c14c0689778e741dd19e8c9c1a161d7494b2736790cd8d6b76187

SHA512
9c078460528ccf52d4638d3cb306f7dfb0fafbe5366c2a29d0b93fd122d16aedb59c37e261b1aa207fc314b19f5fbbc55090ab60a5e52b069a42660c068fc62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
97b0bb1c1d5ded99ebcea681f3e9e04c

SHA1
62a44a4cde32b2d69dee97a931ef5deec6557eed

SHA256
822edb636836e5fa4f638d09537639bc3f0d9868e9b1873c7e70e0a3403247f7

SHA512
dacdad3bd6c500988e76a295771f4e5d48bd857679a4e96a20b3765ecc2f1b8392f0354ca64b051066f582559eec23a8cacfb7d1980e16c452a7c8ddf5ca4ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a6fd9342c57b9be96b943c18d1db74e3

SHA1
232828b78bb9405cb5433c2071a4168d7bb19d71

SHA256
80fab9c48abc88b91d67a2bbe2aa2a2ab8778f68398a4f530f7ee872d5100c9b

SHA512
6ba41d5f90c67581b93de971dda8709015f88eb0a5cc0a06879d1fe7084f8c9361fc7ded4539c0a163b4d0baf95aee029a3d99ae84fca5bf913588a3f5c2b933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
95daba3f65c6b5fb73af79522d7c7af6

SHA1
be6ea4b1134722bf7eda24eaa123831ad53f95c4

SHA256
0ed814fd6aba1eefe4156046a04a5e4bead0a85b023a8502a19d6ac9beb4af90

SHA512
2ec82780e6f588e88340f6aa0d9e2601824fe390c99dea50ad2fe4bb75a5fc1da244eb9216834d946818beeba69d1138deef4f803bc36f9f58278ac65362a2bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
46bfcf1008c2e01c1fc018ab5df19102

SHA1
d4470d283f0f7433a7c2f00a8a28380b9fe9efb7

SHA256
a408164ee7d48b95fbc371331b349959738144e8c4a8998258620d343946622b

SHA512
f350d5ab1ec899a8bb673e4772f3ec11a181b9c6b6c2c68178739c8082607c5b663f016bcc3abe682708bf352656772531c9b105a3ca1bbdda55900153865fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
42347ec357070977f52b4f359a03c4c9

SHA1
5969dcf6a264460ce65c88c4a492849e4d3735b0

SHA256
42ec95fc5895fb0072fee8187c0ed2425da586c4292a088d6b0338f071207c1a

SHA512
91234cc551d20612a920e6d918573c88a86f332038766fe3cd4a5f1d46397032b772b67075ecace17f2a37d2cd05a195460dc1baa6d9a9f4e0b4fd8e70b1730f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
deed1bdaf140c05bfb09733264c4d4a8

SHA1
8b4c6a23e9d10ebfc47906235e0dbd11d2ce39cd

SHA256
42ba9d8229fc695d8041602c7e00e8e98a4c706e67c9edfab988f2131401e9d4

SHA512
790b57ad2f1f067129f74bab354bdd5cfd260567c9b27838d45ea7c91d61179f002f8ca3436af664cbae6db9472f056917a70848a40a55da88a733cf03ad860f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8a2283cd75e15c649fa4096ce013fe85

SHA1
dc3480243079f7f94ca8859a004e8785b86abff5

SHA256
5d47f98bb6ca71b33c31863cb3708dd435de844ef9c68317efe847da55202226

SHA512
5bd04e8be93f52708a176c229219f2e4e57f8fbac9bb6eb31bb384040c8268db74880ae5b819f05018595cf654e84637099c5c5a19fe005310347a9b6f17b408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b788.TMP

Filesize
2KB

MD5
73959e06549640f8ce61067d620fbbcd

SHA1
b27cbbf7231aa8d002cf085959dd31355706950d

SHA256
3c872614087402535ab7d33ba2b18a22fac5a94ee3aa04d7c88f3940b0582e6e

SHA512
7fc77faaac416ded1c948dbb1af44024378b6e8e18cb3ad39d9df06c3b839cc1aa96df73d767f884a9e91d8921039219e4e8450fcfa7ef593fd2501f386a6f4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
202c0261c10758c47b8ca55de390a37d

SHA1
5cdfd7a493149f1da178ca7b0168c8d9f2586464

SHA256
c7110fd21043dabb7b9ca1ad18f677c3c5e395e6e602ec42d8c74e81f08bbc50

SHA512
321fbfbbc5356142485295da254119cd1a39f6a19fad0b421362f46ea43d5c20e672d197df979714ecda0adfaea54ed226cdd399c890e80f0a402fe722327f7d

Download Submit