886138eaf68d2b11e6cbe3750acf7dea29fbc8141996220c31a9d8d5562485cd

Analysis

max time kernel
130s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

797KB
MD5

8806754a9b1492d27675c8e3dbdc6cc7
SHA1

02b874bb14fa3674142277590bbfb35a5237fc21
SHA256

886138eaf68d2b11e6cbe3750acf7dea29fbc8141996220c31a9d8d5562485cd
SHA512

29e5b0eaf734c1088e568875cf750981448e2e539e57d398bd2aee9c85a0dd11aa521b9f79f0d1423c6a755323327ddcb41d5b347bf40b59cd8233ff0428037d
SSDEEP

12288:SgBNT6NGm64BppLRE3KEIBI3Kobryoyhwh5K2H1tMzoauk5Px0ZASoZQ:SgBZIBI3KsyojMzoauk5P+IQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
4780	msedge.exe
4780	msedge.exe
2544	identity_helper.exe
2544	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4780	3808	Bootstrapper.exe	97
PID 3808 wrote to memory of 4780	3808	Bootstrapper.exe	97
PID 4780 wrote to memory of 3008	4780	msedge.exe	98
PID 4780 wrote to memory of 3008	4780	msedge.exe	98
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3668	4780	msedge.exe	99
PID 4780 wrote to memory of 3152	4780	msedge.exe	100
PID 4780 wrote to memory of 3152	4780	msedge.exe	100
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101
PID 4780 wrote to memory of 2624	4780	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Bootstrapper.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa811346f8,0x7ffa81134708,0x7ffa81134718
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4507069067159830780,7147842489064631314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9779d4752428d6d7b0a7665fb4e8741d

SHA1
038d57d744790a87d8654b7d031f9282b21d3253

SHA256
84719451682e1a1330787693046c521387da13a38b069a86dec15caaaca137c8

SHA512
92888351b990fafa707f6d1c5c9c061cfc7f162943b66b3b9c6fefd821db2f49305139750c12331554fc54504fe15af337ca5ceda73f9fb954e5596c13286329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
0a8ea5dae27f141be6436c1a828dc840

SHA1
d69f06ab302b56ead0af142ad60f5ca8acb4f42b

SHA256
24c8b87b69cc0aeee6ce898bce60dbdca51dfa690e7e0720b58a87b9a16e52e2

SHA512
289759ab1f9636c6147526f3419bff7941f77bdc327ba621c5ddbf334afab9723983ff9ce59fb85c3636d63fa402a50becaa9c232c04afc825509652ce2074e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ad88cc944ca9ba4f56390d22a4488df0

SHA1
ad1bbe15254f0a2b23072879bf87739c7d9ce2cc

SHA256
2f94fcb27947be78a3d6219139d6611aa1e8e98c789f581364495245078770cb

SHA512
0b96e47fbe6159896977b2cbed2ad90583ac070b3a681c2ef2b57c9b316cccf6780078105b1d3a34b0d2417dc170c6c5e316fc19e7a242b219e0c895ce72c5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5c9dbaa9ed5d1647c5183288eed3756

SHA1
dd248bdc6dda17fcb795c1eeaed20bc603a39417

SHA256
25c2ade6ddde55d4ae52de929b37fd0f26bc784a026ca74f0cd20a930d61ba1a

SHA512
e0fd07d62d0c0c874ec639d4daa593f71f584aefd78abad6838eb971c66733f27098d63b34d573ed479071b4a434f755b87ee606b00c4764a7984ed0adc447bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
358160e161c787bdbc055532cd86a6de

SHA1
d8c11b4e0ed2648585595e2cc539243281c5b133

SHA256
55d970ddc2520a473e5c268d7ff995815002a8e7d51360dc926060c43e489b6a

SHA512
61dd8409d2794e6cac48adf2b045e982354f32d6df0e8a23d020e4c40aba5c0a3f995ad67cb30684b32ecd3d1813c917ad3553829418d67965776ea2370b5359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9585f0ddaa2bcd238acf4c29cf69ab1

SHA1
53668e236a9702018986cfa05489f38002410d12

SHA256
f03e7b881059dc79756804c81b35804b675f27f427b9f722c5e16423bf96d17a

SHA512
796befc7c18e2a75fc656195be5103870f086c6279334a46c4ed0d78d381ac643a54a4c81fa345846801f9af728b9a6189e4b6a0d74d7663d6ae787523148ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8809f04de6ff02878cb7abf1f7fc9ce4

SHA1
0dd385c7538b4bd5a63f854aa91f960a0cf5ea1d

SHA256
547b367bdc423f3815da313b146dccff5706e8fc42dfa17139c94bd74e8c1943

SHA512
f2b61c788ce4f9858e2a4520c3f25680f2dd2e853c616faa7b050fd72fda10f11b34c2462f04bc47d3a30cccde4e5141f9a1b15e9a263d52e4e1751297c66285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2447990dbfd724a0eb86140231e89081

SHA1
11859c530d4973ee9a477b9912b95c332a841881

SHA256
0fea451e07913d9dd559bff7f6c1be2485d55f9d6b6fdcf4441346ab154ce229

SHA512
2e273edbe2ebb729b0abc774652005ca67bbf8f5283408d6d1068ae9b41595d3da6f6f3ef6e7ac04ba73d8372bb2d7d9d6b6f0a2eb98f0807f56d3765ffa8075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59b898.TMP

Filesize
371B

MD5
5fd1639e313523abf2e13098a713b46c

SHA1
527979ec36e8a0985bd38034beec9f260e4bff12

SHA256
1fb6eba664f16a936754bdbc0a3113ccb22c27c3db7c66a1407d2461aa723195

SHA512
b180afd93615b0cd083e200472603af8c37f4d83398bdd29c3a708b1fd873c4a6233c87d2eae5af76163a021b546055c8b0235cde28b5b7b04dc07c5b90ab06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ad61b433a41ed6e0c4e9a9a8035b851

SHA1
179086c68ce87ba703dd0b4a08d3aca8f2a333e4

SHA256
8d5b822abffbee39abad82fd9fce2f430febd8b9940d57c6009b7a0cca33084f

SHA512
648d7159ca4ddcbf304beedf18f0f4303f8f741c16c5fd262e691e29baf059ef1494b551c4d938ab5b83501371e3bd5a9e9d243332dc6ce0d91bf1a92dd6cf6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8496c294e6dc139b897267248aa922ca

SHA1
bc4d34c0ff7944fbecfc52f36acdb464a07b33e2

SHA256
28f32acfd619cfc18284bfb1acc3cbbb8d978acc8f1af199a059f10789708774

SHA512
d80ee9bb8f5e11506b55fbadfa6c2a1affc274c53026a3d7807835915f7fe8d539454d700ca6250b02cafd910729e8f916fc3cb49ee3251d872a279d6d957981

Download Submit