hxxps://t[.]co/6YiYDwX3Af

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/6YiYDwX3Af

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
2716	msedge.exe
2716	msedge.exe
3904	identity_helper.exe
3904	identity_helper.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3376	2716	msedge.exe	83
PID 2716 wrote to memory of 3376	2716	msedge.exe	83
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3240	2716	msedge.exe	84
PID 2716 wrote to memory of 3716	2716	msedge.exe	85
PID 2716 wrote to memory of 3716	2716	msedge.exe	85
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86
PID 2716 wrote to memory of 3972	2716	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/6YiYDwX3Af
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81a2946f8,0x7ff81a294708,0x7ff81a294718
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,16179279981258429192,17785390753042251778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
da63b71a58cf1b1098218f10e2580d0a

SHA1
7e2e8ee340114667067c59c6e9850a3b72e6b528

SHA256
fe61015b5994b501f2e7539da48e32954100ef509418886fd923b222e1161049

SHA512
b622299817e1269809e8a08c0672c5ef3fe2232c75a377809c45a0c964ab2471399e7f2a6065cbbfe9ca8788b8e57dd7164d9edd04862917e7899b22ebf0be2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
46544e95e4022ee6b546a6ab0a9b13c9

SHA1
4e23634c751b2b8827e12328f2da524e887ece84

SHA256
66b8d932da194a373f99c119f3355ccff681bcd1f84039a1686a69a664e92496

SHA512
6ac7059467576fde1540062332b57fbf907fb686e62bbee1d413270046eee629524eccd97de4757b186ec7d0a4d4b7e4457cd07ea3acf2b9854888bb827b1d30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a020473c37aa8bc1e9283abb50274c1a

SHA1
adcb2fb57ba8d20cdb3b120ec1524b943f23dba0

SHA256
a5509dfc1d7dfc7e05d7bdf1c182c43926b3288a580d0960c550c0836a3a7110

SHA512
321b642e87f6a07d258f4beb2a9adaf54d0185ff5da38bea86bc517438e042292699a88dcf2115878670736b442e8ac26108373637d7b1c85b3adb7686262c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e08d2fd26765156b503cd76f59f88921

SHA1
2c1379061be2aa84848ea5ffc18a0aa060077998

SHA256
06d4438639e109e2259b65cdd8c1b904357d739227afa44dbb46ba37b1f4b2ed

SHA512
054fee854b07cd3a076d513941e7ae359145f3293344aa0cf6ea7ea3c2a0f392367597521933db33760b23ac31980f7435c8b42bcad48f755725e9adc4cdac72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e0e0ae0359f7b0dac06ac02fcf439fd2

SHA1
b1f6f8a7eec3dbc0e6d69ddfbb0524809df30972

SHA256
9c946870d8b371888db5a87cccd1b08eb349385ba953169c079337e17304b3f5

SHA512
f73a6493c2e37524d8d5fdcf690230dcdeefbcb9912ac728d9a684dff48e23b832e80ad0e2296ffb6769e4a6b3151bf9c635feca3b74635077d68d8d7b43b838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58219c.TMP

Filesize
371B

MD5
def287083e96dd5586eea4d53f73a6e2

SHA1
25e01246e3dfa94cbeba91248fb8ccfc4ac9fddd

SHA256
f3ef966313e380a7c7eeaa239d3e54bc5726cb2a3449b3276fbed96b196230c3

SHA512
d5380af6c5637e768e2e94ccd92a920598894221cb6957a8570713379ec19c3da208882faa04a2441703e22d534af8e4529a4f56b86593b30d50e4bece23008a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1159380763ced8890715784ab3078c8a

SHA1
c318428a058da1707be1f6cc19dbac2d8e78c446

SHA256
c62a0f5d4a50079157ad1a59bc073397b25a0219c077028cd41f91d0a9631063

SHA512
8c4e751aba35655fa301d676cbe97e0580477e522a4e00fd35fb0391be1de01b371984cde9199a5d43af23f2859a03cdc15dd564ea8370f11e69581175fe0657

Download Submit