hxxps://sales[.]ansarada[.]com/t/10697/sc/a3ada7d8-cb14-44d8-8007-61a67d5433e3/NB2HI4DTHIXS65LTNAZG46LSMRRHE4JOOR4XAZLGN5ZG2LTDN5WS65DPF5FDKUDDIVVXOMQ=/GVQTSYTCHEZGCN3DGMYTMM3DMFSWKNZWGU2TSMZTHFRDSNRYGBSDQOLEHE3DIYZX/ush2nyrdbrq-typeform-com-to-j5pcekw2

Analysis

max time kernel
117s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sales.ansarada.com/t/10697/sc/a3ada7d8-cb14-44d8-8007-61a67d5433e3/NB2HI4DTHIXS65LTNAZG46LSMRRHE4JOOR4XAZLGN5ZG2LTDN5WS65DPF5FDKUDDIVVXOMQ=/GVQTSYTCHEZGCN3DGMYTMM3DMFSWKNZWGU2TSMZTHFRDSNRYGBSDQOLEHE3DIYZX/ush2nyrdbrq-typeform-com-to-j5pcekw2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
744	msedge.exe
744	msedge.exe
3280	identity_helper.exe
3280	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4440	744	msedge.exe	83
PID 744 wrote to memory of 4440	744	msedge.exe	83
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 344	744	msedge.exe	84
PID 744 wrote to memory of 4872	744	msedge.exe	85
PID 744 wrote to memory of 4872	744	msedge.exe	85
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86
PID 744 wrote to memory of 3812	744	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sales.ansarada.com/t/10697/sc/a3ada7d8-cb14-44d8-8007-61a67d5433e3/NB2HI4DTHIXS65LTNAZG46LSMRRHE4JOOR4XAZLGN5ZG2LTDN5WS65DPF5FDKUDDIVVXOMQ=/GVQTSYTCHEZGCN3DGMYTMM3DMFSWKNZWGU2TSMZTHFRDSNRYGBSDQOLEHE3DIYZX/ush2nyrdbrq-typeform-com-to-j5pcekw2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7601863581796430466,18405315450556729997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50daa515-2725-4917-b612-77ead8b0c6e3.tmp

Filesize
6KB

MD5
4bfe4cc39cda9d5865bc83bbc6434cbe

SHA1
27bd4cf4e1aaff9f2540a16e56f170dc610284cc

SHA256
27ae8bf1baa6e813811a74b588f24d6c165a5c73ddbc5d4850d8ca4674d34e01

SHA512
814451a85ee3b1c8244e4d59e6a65793f31d2164635c8c3a59f30dd58856a92adcd23f84eebbcafd7e47d4005b5e07721ba79873ed1cedc1a36e2b152c2b9d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84517085-0e5f-44e6-a087-713f18ee8d5b.tmp

Filesize
1KB

MD5
f3f84d0ab2dc88c594f2fcfbede2b829

SHA1
eaa0c40f29d90a53c101d4c6bbc8feb2c9d107af

SHA256
1e6b8930a6e63863a1a2a808851282b035873e6f90a1d5419c37414f1de23c27

SHA512
e4ba44044ff6bcf18058da85278a2ede262f36eef8be5e22431ac2faca1f15c2e166de79c66cafd0f4bcf422bf54dc96ea3699230413ee1eb8249a677c09254c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
a33d5f14b48707a150b8d5ad28fd16f4

SHA1
cb97fa7fb05d0db030c8c3ed867abf7a84b64fb1

SHA256
d1fbd7ba9f68667413c15e62f901c7f2ecbb6a3f7b5c17bb76f3b76b0ad71e88

SHA512
4a34ae31a99c34671382844ca757b8a5f260b8c8f0cf89b41873cabe1ef4001aec962a9f4ea86279a0ac14c72f29226d23c2da66f54a483e8df8677c240b4ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
36e02f2face8d1fdf12c8b153b0dc058

SHA1
b8b732373160538fe9d016a45adf8b6bc8946ed2

SHA256
216fe749254646d29c06206e46320274d9c04c5034cd832f5f80587a117231a3

SHA512
e8b9606370624550ab37b71921af1ae3497abe0baa04e4549526411bdeac202272b61ba0aa6a9d99d397883c786fabb1e6fdc8dd79f04a5d33f92bce89cdc51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
3fb6dca575108ce0ae295c89e60a9836

SHA1
502a434e306a7f1eb44d6c6c3e15f161ac5c2898

SHA256
ce3d5b3c8cfde6e282fa9c1610959e6be0720533eb0444002cdc234f71ed8dd4

SHA512
0763ff5ad22237da56090cd0dbe2d6cf2339bbae0a49d34c84017334ac978e308c7ff882a16958e8a50470f34cd9e9832a3b46a55436a63dca6d371817c53336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
862B

MD5
8992201d16b611309550afd3305306d3

SHA1
b7de595c1438e0964f50887af0e55aabe5aada0b

SHA256
304093df7962247bd2925bf09dcd949f38487e4088273a23e60b4dfb130e3f5e

SHA512
386074f0c337c6c79454ecc68e3e1097463c9c92f9411ebb2903eb0463bf9c4dbddf49b7c21e4d946e9f87ff133052446b178b62c75a8a542b346fb5fb2f745c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4e1d60a2924da74d8df533da08ee9bb

SHA1
d079a3c8798a1867d5fa304f3f9b2eb4f24b958d

SHA256
17e4efadf8bd5f056e0d2a27c1700c6d94cdcf8b3e099fd31347aad6a6050ee6

SHA512
6ed083e35bf9ca189da621e48a7e7fadedf1de8f37402ff9a436c04358addf28f3043f7c159f95052c1a75c233b9fe653fae5eeee17ec13a662b77f929046ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ae032c8bea35c2bb1eed6e2afc65224d

SHA1
8a35d233aa46c01aba17634fb0bd83e1bc755e0a

SHA256
d9394570c94c89ceaa49555190f0fc14317e00a79f94f23f9937b4469fa7ab36

SHA512
c5e6221bf0ad584b80dc3613c54f415418737b5262d3dbf1e2d78bc00c5b1bc9d1b0b91f775606e93c4d975ec65cb94068e8c4ac0563b427c3bff288639bfc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
018eb9c2e502b646888ce70d38fb4fed

SHA1
ac2b64ffbcff467f12e5b2c2c379b8c44b3d1f2a

SHA256
852c546e7c9eb70092898fc2dcdd6d3571acfa06454fffffe58b4d7ca38d0214

SHA512
4a3df5715889833d7a5b4bce9a8e45df1b4990684a0be622aa69105b6fad67196294bcef1c1e18761e7f8bf02719a0263b1f90eb34da3c8f92b4f84a468a21d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c3c091477aa154d46cc7967ae016f30

SHA1
7b5eca8935796108fc69f3f11a5945ce61d565f8

SHA256
24ab275e19c379aaf1c2547ee408caf0cf4df12cc72e071340de3eb66870527e

SHA512
5e0d631c96dec41fa9ab3b9f3ab9fa309a39a25d5fdf4e27c795e71e049652131d2dcd16d40fd2426ade5b6329d2edebce7526efaecd531a1a2d7dbf13555937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
7028d28dad08ded44231b25a9e0b6b5e

SHA1
bcb43cdeafe5b3f773e28dbfd9ffbfa0bc238e40

SHA256
d535ee512b514f4b9283f7c16bdab971e829653bb23ad2eb23098e82776dbcac

SHA512
997f0852b3af62cd9382d86ed1384d9454c63b65ae76b7512b7019cb75f886c75e3908b5f3782a026e5f63147cdab0fb511e569b7ab718f9f1ca5ec81b3bb225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
46a174e2c95f5137d48c2c74046401a4

SHA1
06a587d635519263b05a599d75b32417d7830066

SHA256
27be7903aef31ec5dd37ed4c5e6ce8980293d73467fb40ce0aff759d16db8afe

SHA512
fb4e749f37336794c8cc1132ec180c25590e760591dca8ad1d5fc40b7d2d1c064da7ecf4fbc173485af36d884df64dbf692149326209b1963179e04d81afe145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be927899a3fa30ab6d352657a4426c17

SHA1
47b78bb5dc25771c989fee0510c06bef8059b436

SHA256
6257e0e033e0cee19ecccd032b76398c6cf0d33a83359d04d47e29d4d9d368d1

SHA512
430c13ddaa26ccca415f6fabff36618960e170c18a3c1d1463cd535ccb3d208a2aa8c83474d60f7e8e27a74ba6b91f850503fa1e1f7bfee96cd3aa0bbeb50dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc9607495c39275239b83887e0db6ab9

SHA1
00a65a95f316e8ef5d5fa25a3120439ec470c849

SHA256
1ae41fe3158b6c13ff3a6ca8a1ed644289d69b9f0fb3f97f6c139b8631514649

SHA512
05942b8795c1969bcc72ccf43de08a9a38f316b70fc3c4db8782b8e4a556a22021e3d223004f114c7ba424e88b80c5234a0dac8287c6282c04b74520b7bf6c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ebb8.TMP

Filesize
871B

MD5
60eff93072ab7b16201f5cdefbae25a8

SHA1
c5ae6853201fff08f34229035a6d9589895a70fe

SHA256
a874c93290a3152a527b0cfe47d12aa87fd8b38b29f9b4b258586b4b0b82cd82

SHA512
8de5f519d81b2c6a4470aebb4bb2c9223d517ebba6147f96ed3db27fa9e5cf19e596a0ba1d39bc1c813f019b5d96cca0b56d5b3900c6a2e0b6fde0415da3d48f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7dccfc2a87ecb522a59241b5a4b3defa

SHA1
cb0edeefaa22cd30b14865a41cdd309581ee805f

SHA256
ed4b35480e3556df11f381f5758cbe5085a98a678338af12b8fa2bef4a253763

SHA512
bec271fecafe1745431a5523d756baf7ca33f74918ebcd0a7570924595f081f8c9b2a8c142c1d83efb1dfa2b10aec9171819e8baec0662c6264f82755c388a8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit