hxxps://hafla[.]us21[.]list-manage[.]com/track/click?u=46877d2dd211302a7946349ca&id=ca00be953d&e=3072171aa4

Resubmissions

25/07/2024, 14:03

240725-rcndcssdpl 3

25/07/2024, 13:56

240725-q86zxasbqr 3

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hafla.us21.list-manage.com/track/click?u=46877d2dd211302a7946349ca&id=ca00be953d&e=3072171aa4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2572	msedge.exe
2572	msedge.exe
4028	identity_helper.exe
4028	identity_helper.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 4916	2572	msedge.exe	83
PID 2572 wrote to memory of 4916	2572	msedge.exe	83
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2492	2572	msedge.exe	84
PID 2572 wrote to memory of 2608	2572	msedge.exe	85
PID 2572 wrote to memory of 2608	2572	msedge.exe	85
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86
PID 2572 wrote to memory of 1292	2572	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hafla.us21.list-manage.com/track/click?u=46877d2dd211302a7946349ca&id=ca00be953d&e=3072171aa4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc456646f8,0x7ffc45664708,0x7ffc45664718
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,17479016800880437069,10118648030545666985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e49b0b6bb61815eec0fb8f473dd9b673

SHA1
28fbff427c9ec1be755f73f37a6438d158f4fa23

SHA256
ce10ca124f4d0758bc2cb6592659969d318a9e53423a241fdab292035dad7892

SHA512
b47d490acc0140d7f1baa5bddd54b0be0e04e8b5d2f78fe90767fbac06e49158b707102d1d3d15ab2defadac56e07587ab2d80857e24d93e674d872338e5440b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
49b7f5b083eab37a63eb2c91e98d858d

SHA1
f4acfac04952bb3b2c45d48a84edab3f3457ad70

SHA256
7c3c463d198b355cea43c76fcb8eb84d7d21feae20ba05bcc507cbef1751c170

SHA512
8497213a3efdf4ef9541e22e7d1b08b06670548a53daf8696332a9938359a6b608cdf6b862629a82e144e5b5f1f8dc93e56c1c31c4f0d1716cfa01e7ac86eb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2312e82f833f5dd64363179280223023

SHA1
c90b2afbe5826c3a3f45f196b53c50312eae010a

SHA256
4f7b7d90d7d066df3eee281f039e8636fcc4d63341ee17b1f1d8852a01c53ac5

SHA512
153f6f99980a3e79cead31016a4bac23ca07da59d1e5fa3ff3347a2161bfc12094affb9bb8a6fe171309555700086e17a18075886f02855de2d19fe78d1dcd58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8acaf1036596940e6ec8f57ad8084ae0

SHA1
5446ddff51a7c71eff8684a62a4e48400cd767ff

SHA256
f1a3d594dcd493973d16c786c8bf63693d90dc5ddc43b4ff5811d53b8d395050

SHA512
0fd40755a4c6f5f9a7a462e6c0fa11b9a497c7909619a5498883842864b100041240951095359750536421d2cd19453949f5e5207015f63c34145bd8180a304b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
91f1c88f022440f2254b043f653e808c

SHA1
bea28ac17d2565449723ad402d1f528d198b5456

SHA256
22035e6f4b1e2a66ec21935dd116953c604132dc4d9e5e8be83d82577d378ab6

SHA512
477a402aa9f8b62e127c0c7a10f3eed6b10d1fb55db1b1a558e3befaf7a8dded382fff1811b4162195052fe7c508e8c5a2e803b712b098a858bff7b94f1c1a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8344705cacd5e7fde4301185e66f1152

SHA1
e1b16f12c4468e2f39675db4de5ecf8d4e4a5371

SHA256
ccdf19474d6bd6cc2b784f25e1b5ffe4d0ed32667225df82e8489b34a41481dc

SHA512
92073cb07a128aaa3e29bd53f048651faa7049e924d4ba99825df07a5490ee804e50e5f2384b3d512e1780179a5157a9ab10b0f67e318ccef5b18b5966f18f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
d1c8f7f1bba618d7aae91d3d41cc92ef

SHA1
9c1182fae676f7eb2f0ccf545c4cc44e8cfa7558

SHA256
bb2c5d53fcde95a2c8bafa88e2849b6da986674606ff60f55b8e08ff95e12496

SHA512
296be99b4bcfeafb170fa9b6b927545aaec7a338e530087f23a9cf7288efbc6cf402c3717a308e85af2b6f65c7024cc66184b9b056283143ad6327ce3430ab3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5ab9f083db13b6a4a353d1f68cc89bcf

SHA1
e6e9473e5487de68412291cac3b5f0c85aac990a

SHA256
9a586507e244027fd0a0cc508378b033213e1730c3775524de01d55a81975f34

SHA512
22737ef029d4e9d13684817a769f69e91ce13357ca7b9eff6ceed996a37ccbb935dd64ae5f03959fd08f9ab4799a7acab2155950f16516290b1a0670d49983ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
02c19dc39632f94dda3f97c82090ea8b

SHA1
20d8364be3576ed7ce7f9a17231a8cbd0253e549

SHA256
f426e27d08b8749482d45f865f3a0b8ba138b95bddcc26de801917ae0267da2c

SHA512
7330550b5adc905eae7df5435182d1c39134328b36de872d300e8f581bb4f1e8264685debc0d3c906102ef3016e43d4373cb39ef3ed5106daa288bcc46bce98e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5899e9.TMP

Filesize
874B

MD5
867958dd0366bc3cf6ee057869a05caa

SHA1
2467de4a62529914c9d382541d49073ee73ea0a8

SHA256
09de54d5ef447346d53eb56ab7441bad24fa9e887cd90e5f4eaa21f8de5bafac

SHA512
02a293522b5b8ca01a85b762aa77a2117c21abc6cbb46a05791cfe2886e91e34f77bf9d34d07dcb7eb6a2f25b30b403c0c70cf2bade7cb3fcf6ccbc0eda0de08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf5e797d-a0d1-47e4-8727-b5dc9ddd015a.tmp

Filesize
5KB

MD5
683b2c0e85bbcc2ad38f2e3367f7b2de

SHA1
feacddc611e3a08f6fbea9acdc19466c0386e6ea

SHA256
5309c2e4adb1c1934718a8eb9bfb0c46c77877b889c7081f247fae8e6c59bb53

SHA512
87bc099780f5bb9cebd48044b2a0b3f5e12d55da92bf3f2d83656661642f7772ec80186af0666f8f15c83e7aa09a59d55b665be6cdfaf4fc632b85cbc00338f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2859640d153d2ab112e69957a17de3c

SHA1
e6baef58638b3e75ad0fc5c5409574229f0df38b

SHA256
982b64b579901a9caadf71b07138d1a791ba9ad51030b8556b8e9b1fc7aa3c8e

SHA512
b152f424578b6388e392323553e00dc2ce83bedee1255f8f3ff13c84a7cbd351e22956a68b3576b9b720de58d185877fb245e0df88c01542f7e9b3d355122aac

Download Submit