hxxps://links[.]freshprints[.]com/u/click?_t=63d5b907ccb84015b086bf43bfa06fef&_m=70aa0b179ae54c7dbeb68ac238c7c2c5&_e=_m_w0EJdhdm9wNLLxFLPbI5sQxsRQA5ytLNwMa89oYo_OpmD3qpj88NLAi3lMMx73mxcbHfqY9DG6DOtNfgsggqlm7fFTnEgJqyXtQPKSmm5U0Fa4Y5Dwd5wHpjCetkAD88kOxKsZpyY9vta25WX8SGrsn9TLFyMWrhxV_zo-pbpYGjNdEgc_j-sM0T-VD6HubsyYizDpoy7WJbewDjpPkT9Zr_krWl2Labvg-dw8aWU0ixOZ6fuiPH9ZX5f1A6N4AEdB3ZP4zSr3gUZoQi56M6MmwpLMtH-5IsSISjcyUmsExP9ZeaLaqlcBDiucX-u_8fBPzb2BycN_4MzdRgtbiY-0gfcmkBBk4-P_4kVMeM*3D

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://links.freshprints.com/u/click?_t=63d5b907ccb84015b086bf43bfa06fef&_m=70aa0b179ae54c7dbeb68ac238c7c2c5&_e=_m_w0EJdhdm9wNLLxFLPbI5sQxsRQA5ytLNwMa89oYo_OpmD3qpj88NLAi3lMMx73mxcbHfqY9DG6DOtNfgsggqlm7fFTnEgJqyXtQPKSmm5U0Fa4Y5Dwd5wHpjCetkAD88kOxKsZpyY9vta25WX8SGrsn9TLFyMWrhxV_zo-pbpYGjNdEgc_j-sM0T-VD6HubsyYizDpoy7WJbewDjpPkT9Zr_krWl2Labvg-dw8aWU0ixOZ6fuiPH9ZX5f1A6N4AEdB3ZP4zSr3gUZoQi56M6MmwpLMtH-5IsSISjcyUmsExP9ZeaLaqlcBDiucX-u_8fBPzb2BycN_4MzdRgtbiY-0gfcmkBBk4-P_4kVMeM*3D

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
460	msedge.exe
460	msedge.exe
1656	identity_helper.exe
1656	identity_helper.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4640	460	msedge.exe	85
PID 460 wrote to memory of 4640	460	msedge.exe	85
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4432	460	msedge.exe	86
PID 460 wrote to memory of 4624	460	msedge.exe	87
PID 460 wrote to memory of 4624	460	msedge.exe	87
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88
PID 460 wrote to memory of 4884	460	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.freshprints.com/u/click?_t=63d5b907ccb84015b086bf43bfa06fef&_m=70aa0b179ae54c7dbeb68ac238c7c2c5&_e=_m_w0EJdhdm9wNLLxFLPbI5sQxsRQA5ytLNwMa89oYo_OpmD3qpj88NLAi3lMMx73mxcbHfqY9DG6DOtNfgsggqlm7fFTnEgJqyXtQPKSmm5U0Fa4Y5Dwd5wHpjCetkAD88kOxKsZpyY9vta25WX8SGrsn9TLFyMWrhxV_zo-pbpYGjNdEgc_j-sM0T-VD6HubsyYizDpoy7WJbewDjpPkT9Zr_krWl2Labvg-dw8aWU0ixOZ6fuiPH9ZX5f1A6N4AEdB3ZP4zSr3gUZoQi56M6MmwpLMtH-5IsSISjcyUmsExP9ZeaLaqlcBDiucX-u_8fBPzb2BycN_4MzdRgtbiY-0gfcmkBBk4-P_4kVMeM*3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e2d446f8,0x7ff9e2d44708,0x7ff9e2d44718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11464967209339419040,3846807892056274472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ee432ec356cb16a745785c205ad2c5d3

SHA1
7db89bf7eb8c4ce16a034733247d88e705c6a3aa

SHA256
f2df1837c0084ded682ee75f189cc54b7bd5a7556b93b474c9100b6aa12bbb2f

SHA512
08682fbd363977e4fa6ffbf2505283587b0d01351dabef4ad175596cf705354e26e243ba49f62a27c268300d4f1a9342938cb790ff04952cce9122343ebe5e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
419B

MD5
caaa793526d1a7ce83255512d61ce9fd

SHA1
00236300758c5b8e6c91f78b1689e52b8f0e3f03

SHA256
75b77b511b7aae2145c31254691c8b0aa205e7bbf4765ffdeb85082db30ea437

SHA512
0b1a203c994d8a91509d71553b96c74de017b19579fa06aefdec7474f96a2c19f8e209a377ef2b236cf27fde09028bdea65e29a2cde389f542aebb055b91fbe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b622d17103900e5aa20cef2795bfff1

SHA1
abed5eff01c75e7c24e3c41daebfd535d6cdc1eb

SHA256
da9bc7939bd615df125c109890a3ede558c95779df2488cdcdd6c8f56c41b42c

SHA512
4bc5876fccae1b04ae4f5586aea6f24c6d50461528e9309517d7877b00bb6d063283cb1170fd0f85f624ad8efd25fa919bd9635bdd177aea23d82ec6bcebcda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
900a61703472df6847af365facb10a1c

SHA1
6740e1b4b9df08152e0a2b8c837775f405bff9c9

SHA256
4563f747f30448e14bf25c4f8a2c2fd8a7601e751d6e7252c010eaae46c1f1f8

SHA512
d1a85595ae5fbb1a4798f5453752e453e4263c3f1f61db31fa7fedcb7214b10ad6f111170d0016e05b5b08f0514e88756c0b42e70d9520e24581afd272e5ca90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
568e2b24fd1d3f7c6e494c2873a67278

SHA1
6cd4be6edf4d37fb053a50133915a538ba429425

SHA256
16755dc7a1dc42e282b2188af14146dc11d867aebc4f57ab9ff5b6f3a4af4ed1

SHA512
fa7e5bff0d3280a855c89039ec282e6cb98732d8405a3d66295ea42ba087399afb52d61ef4e20fc9c815ea9ebc8b6e0ba2408e0202fdc69dc43a47e48746a8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
bd5b129759864e90a12747cac32e851a

SHA1
6468d84696f26532b9c864343791e4cc547e15ba

SHA256
d4b5cd73c02d9b5e04dd07e59a8206578db55eb5ea5b9b36f4bc62385f4bd2ea

SHA512
9282209dbb4d07a8b1ec925c44f8f72182f705757bdb5f8354e31af8ef620866db834d6bd8ec26dd333ed381830512ae5e586fe2a9e8d09ac61a411b951b0f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c7633a50fd0d7c5971a27e2998176644

SHA1
0e7b83039ff149980ca7c3ce4c951699a36aa8c9

SHA256
24ec255c00318067123e586be4b27ff5d1e6f9eb1f4695750f0255de0a533927

SHA512
bd887fcc927209d434c54fa78969831a9e0759f23c7c09695fed58fa0fc30eeb35cae03ee58e385700d243f618bb7b87ffe2a3b7a13ceee4715acbfcc42566da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5811ed.TMP

Filesize
371B

MD5
2562ca73f8792c1ab71c2335260fded3

SHA1
721f48f430f9aed694bb2eb4f604f1eca59b6d59

SHA256
af9866d588ab8dd73530681b77b7d071a23cf044060562b6f551b9301b00394a

SHA512
76e85aad74fd8196e06ecb218696e275ca2741a2eab1f627b3bd2ad5fe11138529e54365e95203a089c5fc4188381ed405f3b9e820216559ebba68401c324cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3919694941494e1f069488096b27c889

SHA1
e4ce6b361126fbc23eae12eece9ae57d5e3ea00b

SHA256
9317f6b7f11eb3382c048036f61068ff7ee37b53361bfc4d60ceacbce3da7f8b

SHA512
b881fdcd313964d1bc1a438cb6ff0cc331f7b89e42e0e057b68214b7b5cd99e2be47853e835d6b3d6807fe178a6cf0bf89c859c8a7c17bb05d16b7021ce4e718

Download Submit