hxxps://shorturl[.]at/EY247

Analysis

max time kernel
44s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
14-07-2024 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://shorturl.at/EY247

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
1128	msedge.exe
1128	msedge.exe
4164	identity_helper.exe
4164	identity_helper.exe
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1928	1128	msedge.exe	81
PID 1128 wrote to memory of 1928	1128	msedge.exe	81
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 1656	1128	msedge.exe	83
PID 1128 wrote to memory of 3480	1128	msedge.exe	84
PID 1128 wrote to memory of 3480	1128	msedge.exe	84
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85
PID 1128 wrote to memory of 4880	1128	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shorturl.at/EY247
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9da4d3cb8,0x7ff9da4d3cc8,0x7ff9da4d3cd8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1848645858458420349,16011610995213989876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d33f465a73554cd1c183cbcd0a28a2

SHA1
f5c16fc4edff600cb307f762d950500aa29a1e8b

SHA256
22d8c228cdcfd3e05431d7377748014035a3488ad3a0d4aecc334e724245a1f9

SHA512
7cc94f77f3943143ee86eabbfddcb110ce52c6ff0975842e3a3d06072f51f2c48914ee61f24484a539888ad19a7e6a1becfb029485cd5984bc736434a63cee95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
575466f58c7d9d3224035d23f102d140

SHA1
2fce4082fa83534b3ddc91e42fb242baee4afa1c

SHA256
9da0e657652daa1ef86af7c3db62b0af9cce372a5f765c98c68479922ccf1923

SHA512
06503e718fe967076dd8a061b57debdc663b9616b005f8567099a84fc7184880633079335d622c243918efc3356b40e683708fb0583084abeed7db6168a212ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
1659b96c05c171134bae677f61b9238c

SHA1
6f67277025f5d1a3eeb0d086c5d4aa5fd90ca51a

SHA256
8c4fe8ec9c152306fbc852cb3d5ca3fe5f01579ac52bfa8138ab9cbb6f292f82

SHA512
2678fe754e51749d14971973d032de289b00a937c304a68fb5a47e29c427a0ef06d7274ef5e6f2db7534020a09ecb4d245ff36ba162f51108307143a08f602e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
383d23a6d024ba4bc6802afdcfdac2b5

SHA1
cf99cbe8e1f841bf3b03a147c470cb7b30021f1c

SHA256
477c060dc3a1f573baa23dc3badf13f7408f9716d7545b2f8a40a1644c1d38db

SHA512
bad1d4a3deea0502b595767c1f0a141261372ecc61b65479b23208ec5efc0f95a02afca5086738aeb83441748a03afa6b9f1b4a250baae7a61946463dad80eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
53eb49f69e6b4e8f4fd8c19930372481

SHA1
bf7976bb00bfd8b9a40fa7ce69c277d4577dfa7b

SHA256
c2ebcb42babf0fe1100bcf74fa98e6342c4e34eb7976747f7ce91ed6e1462379

SHA512
c05e492ec91de92a20c9a8637f0cf72ee2dc11237e8b8caa23e9520fc329250442df2462522df86c00411e93e811ebdfaf363cb34c2333f10eaf8944d54f016b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a0d8e0cd3c85e445cbf2c86f99da35f

SHA1
dac5d88edfe53e85d7450dc6a29d1d4fe3f75509

SHA256
cd4586d4582dc26bc98ba7feb8792cea07deae7c9ec5b5eff2a7292e2563734d

SHA512
5c773370018c95b5a9fa5aa7f28ae6eb872bcf0dff522d00ad1c44c486b96690debf973d8d1f8cb87e339452923e725f24bd3663d323dba2b8fe79c910c4c5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b25e962f0cfa366d9b18b407163bde5

SHA1
261773c997df758f4e4a73900464ccd4a9b49211

SHA256
3994501fc049ca0411844314deb0dd18a04881b58cca108b79b688a1b494d1e5

SHA512
22d36ce55b964f12c3b48f702da7b22705c09171ab2fcecc8010c608414fd76759d5758fe4c1b44b241ab304a16da40b56bd4f031c2162e1a77843f468acb915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ac3c331960e4c3f5890f0a975aae9647

SHA1
473d09dd5ddc9871c5a8be6ace49a258be00b8f9

SHA256
79246f647f868c737f9e7133e79ca9bca50fb31dbd8f0c19acb991c93310302b

SHA512
e68bad51df5af2036f417221b53dbdf8d287fcd0e9991a7e949877b38a445359011c64ca91fdceaa2f29d64e25ebced066de9163822c251def0745d006082833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79cae5e10467a8cbeed8cdf21535b1f0

SHA1
2fc2d2dd49a1376f958d47f8977bc0efc909ad7b

SHA256
d512c8dacaea576b9c7188bd6b0e0129973ef7acf305e402908ffaf0564f3126

SHA512
4a657a0089eddb2a09fb6944058823dfc9c4c6a494993e2af514037c5b0b865ca2174c4d9777a7af27aa53c470116f8263ac592d05eb2a75734864d73a15a6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75e8f3f83cab1791b3932e91b8cf7d99

SHA1
7495c63999f144cfd7d2721202800b2db29e4b31

SHA256
93072fc9ec521aea8ab034a442cf7f7c2c1ce9e32dcdc699f19fbef56c4be7c8

SHA512
88405a839da8f567db24dd2bb012ecefad688eb0e91a7511474790640226419caa5359b723214020e581aaa828a013bbe0686d7b322b80a4ebf551fe16d5bec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
147c2d0bdf03e09f97a35986dc406c08

SHA1
4148acabaf10b5e3b83b23bf942ad05091b06b89

SHA256
fce626875d2f2f32042c5c3bd1ca0d26beacbf6dc4757c78a605237adf69b45b

SHA512
2c2cca6af7a24e4d725821b05082245bfaacdfb6bc791c6bb94a8af08be5f17ea8094e07eeb8cac7e03dfd700ed68f00586c1d51e6d126ca3101100419aa0fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5851e4.TMP

Filesize
539B

MD5
3ed8786f8f76357547723a459fb08fd6

SHA1
d3c713c909aa78eb06234a5bfb8de629bf18e0be

SHA256
13345456fee02ede21d3c1d1b142471782823c39f5dd4aadc8254bc9b4b30edd

SHA512
d246659ada92e732d88e6d33f997cb267afc2f00c9fb22fe8ae21199fa6679eb716344f54df426f48135d8de0ac0cdde8e81b8fcc116b5256d01b6bfc47b5e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2815bd2b864ade7e0dddf6833ff16087

SHA1
001c868ad753fc3fe03f9d94b2208c88b4e41824

SHA256
9f38ccdbbd559d57700029151ad28a091dff8fed487edc8304648675e178671d

SHA512
ee99c0075aeebd907617d2823776a05f26783f4e0ab4a1a4d5fa389be7d7ad0215ea6872572e26572b93edae66a6a9ec7a9ed37ad44a9fc3850e7e346caf9725

Download Submit