hxxps://sigg[.]mxmagnoilia[.]com/6645cef504c96b22f45e90a6/l/pQo4ZqfnSWC8TaFCq?rn=&re=i02bj5yZnl2cA52dvJnQugXZsFkI&sc=false

Analysis

max time kernel
34s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240802-ja
resource tags

arch:x64arch:x86image:win10v2004-20240802-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
09/08/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sigg.mxmagnoilia.com/6645cef504c96b22f45e90a6/l/pQo4ZqfnSWC8TaFCq?rn=&re=i02bj5yZnl2cA52dvJnQugXZsFkI&sc=false

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
1140	msedge.exe
1140	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4916	1140	msedge.exe	83
PID 1140 wrote to memory of 4916	1140	msedge.exe	83
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2612	1140	msedge.exe	85
PID 1140 wrote to memory of 2872	1140	msedge.exe	86
PID 1140 wrote to memory of 2872	1140	msedge.exe	86
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87
PID 1140 wrote to memory of 1908	1140	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sigg.mxmagnoilia.com/6645cef504c96b22f45e90a6/l/pQo4ZqfnSWC8TaFCq?rn=&re=i02bj5yZnl2cA52dvJnQugXZsFkI&sc=false
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd70f546f8,0x7ffd70f54708,0x7ffd70f54718
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,10861799796915340826,9060111566323445771,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96142ba45f7203a8c4d877b2d70588b6

SHA1
e1d1ac761b3c41ba0a3409d7bec68ca22ae1fac7

SHA256
dac3fb834fb077720a5a79f49add75e37c15bd07ac063b5516061ffc611c334b

SHA512
fe09d408370c5ddfa3264f870118fd2edb2e4184871a8029bb62a438be6da78a8e1f72d176149ce6a4963e9981136dc878aedb1e0c660833482a9850680a4beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b367ffa3cd6896506992c5bb8b91addf

SHA1
93c9bded12fd3a814e4a87d1ab6b102818a9996e

SHA256
a2e0b202caf41d3a5fbde3824043e423cc9ce0ec9653a9d1a2d23b04c1467b96

SHA512
44e2745fad967ce9b7a2be00b75d6617d441ebe2763d81a8c038d57906b1c94d6d57c930141331c39e032a284b59014646dd9054be213fd973e75a2269466a8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
213KB

MD5
2bc5a6de4f0e2def099c6378137cd242

SHA1
addb108ffdf9ae54fc270f1ab2ba9ad3d8f8f2fc

SHA256
f76feaa98fa33905463cbfdfb47be14f35d4dd369bf6784e90147a40d32b554a

SHA512
599f8fcc364450abdd9cb711f3831cfb09ed29463afad5f5590c8f051018ca238926f93bc10980e961b9be58666d90b95b5968171a3b98ee76741be3aa2b419c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df9bb2d2ca7cb10bec80183d024673a4

SHA1
02110316b560dc9dad574ce00c1aa4cbb468955d

SHA256
75b349000e098ba3378099652f72a65bc0a080fd965f5794949d3db5e878bbdd

SHA512
d221a5974182b9bc7544e5b3b7f1e68dc6117065af243b903a7337c02299e11a2d91becf983ac8d0f2740ca688b32720f6c2174c41d8cda8ef4d1454f30174e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4526d32ea1af107b8303fdc4a7742a7

SHA1
c17207626e773683a97fa572b9b28cb9b48cbff9

SHA256
23c7b8e8b615529cbf8d17bd9afebfe8f0f40e7d0ba3bfcb65b0bcc37cf9a9b0

SHA512
5fba2f31ba6ce8bd5028e930fcf322be3421b9fb0d0e2b07b5426972d1792e88ab0710a473e418a7b7c431a5d6d3ed5d4ecbddefc7eb28802d53c34024d905e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8fc2123f185ffbefa1d86c079a55d57

SHA1
70477a8eef87cc909b3e03a6aa643de9918e3c0b

SHA256
61f165f4750094119553770d9205f8c146bad5231088e7ad3d08091fd6af466c

SHA512
ad4b2b3418db4bb3d9c2dd994913ef0990fc0db1ce9cd167ea2bb4f6515fd7267460c328c35cb29b82f6a2a4c25a64c003ee83d9650d7bf1cfb524e660819215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
852d886f30a60b001ee9e16d15da655c

SHA1
713ae02473e2af931fb4455db3be07a00c734e97

SHA256
0c05a4e24bafde15c1c9cfa778ac25eb5552c22b1a589b7b473eebc752a6ca68

SHA512
09625a70076a264b7138dc14f2fe81b0e8ad6cc0ecb3cc4f5d5bd73eb58fab1e2528c5e3a3a40837740895a5a694b94b2fa174a8595960ef122823a4132d4f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c20f9653de77ed9f9a1f2237363b6ddc

SHA1
daabba3de966fd5443e5d2cd0996cdda9aece192

SHA256
e5cc4868b5b43493c1e9bb55526c42cf9561f7dfe9e0a0af0e174e7d8ebb6016

SHA512
d7ce376d1f261ab1540f4066b9432c4c005cc2f883f8c4c2d65a6c925c21e59b5e56152bf6686f5a0fa1be54b53d8bae2a56937fb0a5aa351961017993405327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
94e28b7ffe02f1f243c46c700fb5e460

SHA1
01ebc5b28bedd040c38e0052b1c918606f6ac12a

SHA256
68f237201497f3c18cf9ebec1f205fd0f90d3a5960774a88bcb1333c1f8c6ecb

SHA512
48d8642f78aaa7ae26a1c74356c38c052245632bb5d0bc6713a9a3b3d6dd6bd7e280ea8846f7691c8937135bac8b6273997e6727d0e6bacd1b4c08eccba40bf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c99.TMP

Filesize
1KB

MD5
2b34a551b6ca8ec3fe24e00d652c5c0e

SHA1
c8be4d98aeee1b1d305e8e1da9fb780a9b567641

SHA256
0ee0aca994d2ad0c34fc4a8134b1ceaa4b632cb465f34e444e28f1bc1c73fdcf

SHA512
b4f26c5f89699d54b87c79b03730314a594e8135d22f6f7d4eb13027b4e86b320a419a8147244c904c3fc6705a46c621bb7d8f27ee328191a34ca3681154f9c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
45f69306f84da0485b2a46bc07e3fb76

SHA1
8d5cdf15f75ff87470e115e58ca89e5023e60bd7

SHA256
09f9189aff193ce07d3e53a895a10813dea52053ba331a049010e38e6d17d6e1

SHA512
c7dbbb72b3ffed692e29c5ec679ba72551aaca7c6e074491ac445a51cedcb271a12065e01a0fdc2212a54b2bbe7e75c95a46ecdc0bc9cd80babb947d9388e3fe

Download Submit