hxxp://gey[.]net

Analysis

max time kernel
145s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14/08/2024, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://gey.net

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
1760	msedge.exe
1760	msedge.exe
4232	msedge.exe
4232	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 3760	1760	msedge.exe	78
PID 1760 wrote to memory of 3760	1760	msedge.exe	78
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4080	1760	msedge.exe	79
PID 1760 wrote to memory of 4032	1760	msedge.exe	80
PID 1760 wrote to memory of 4032	1760	msedge.exe	80
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81
PID 1760 wrote to memory of 4452	1760	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gey.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba6eb3cb8,0x7ffba6eb3cc8,0x7ffba6eb3cd8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,15842731475792361632,15540379525546849898,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
505c10815803fc9f81d551a20bc2f6a4

SHA1
f3a8d09d8c6b2dd271d51d8be4be2b33bc5f56cd

SHA256
671f54733f5e248bb98a2499cff56b4559a825a1e2dbe57eef7a2b99999c8d7e

SHA512
704618c2b974adcdd24f15541e89b669ea08568c2f8e1b1d7f232363977b3548cbae5bfdd55582e9ffbdabb2a0702b96f2f63d689d75c0b19b6f01bc76d7a0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
4bc54f4d2003d9af49f258d06d5ebe6e

SHA1
70ebea461d709ed5d2ed4e73b0e84af76cc02314

SHA256
9998e778b0dc49fdce8c11642592fd13d4c0637114c73250f9fd8a57f3d4061b

SHA512
5050801d75880223acc4dbfb5611d484fc4f304cdebf10ebcd11b8007a9da2b9075aa3317a93fee3fac107de3bf88aa40f214410b4559b5d09889b223b4345db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5635c61dd1c43a04f2a63a4b0bcf712e

SHA1
f546e016d6e3ba4cf6492d001541c97ce4f5448c

SHA256
4c669411cb77ed3f86b39a7e4508af5a3ab03906af1aaf3020195304e6395b03

SHA512
ed146468b7a4bdce311b1ac012c64da3b2f4e971ca11c96931ee8789df15b25cade24d434d52b8e2f18d6d27e409312c7f7dd26ad4078dcbed571f96e1cbb0cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f843522ea2f7912e61fa758e0d0b8162

SHA1
3acad350a4e1df83c25f7f83d4394d2057b548e0

SHA256
ea4efc51ca5b4e2d159dfcfdedff76ee432facbe570ff2bb43e26739e3312860

SHA512
e6ca0eb91b175163e964a57723d7200f14135c6ee5bfca97a943815bff0a042099e0dfebd6f8b188ad0c3d65137034e97cce64597e10ca3b2bc5236866598b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
740ce4975608c23fa670f29bbf272933

SHA1
dfef0e0fac36f1aa03279b24c203e1307a6acd61

SHA256
21ff7d01465cf570cc8fced485340cae7d090dd2e53e8adc3b96213181321f9e

SHA512
2d7840423779bf2750aea4bf8f012fdb2b6925e716e9123a2a5c8acec4d3d8800fe0c3093397c056cabf666db7e4a0e5543d90c98bcd8b2658db8cbbd1479dcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c15ec95b20965f4e0a1c7441e1b8448b

SHA1
1da8e9b94852e5354793df8699c2e05942d799d4

SHA256
c4e0a6e1eb83281597e2af509cc9f910e09d49b1aa4eee1ac222c8da403fc3e4

SHA512
5cac11b9f7c77df34a6a8aa88fd5c70a21347fefb824cd8c41ee7626dc2f69535f0a915cef1ebb616d5dff6ac64cb9ca8cccb0dfafeb0bcef0d193c430e29fb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c8e7386c2fbca4f36d581fa86eb1bf3

SHA1
11f6f0622f366f1f66622265a202f86bb06d7a23

SHA256
15f9279d02f5f3126da83e0174f9427c49be17121564d1787a79c4a5dc59d0d1

SHA512
2d747f39694cea9d56194c2929006bb0c956fa3bf94cac543ff3a13ec28aa6e381567707b35fd22cb035e32a91b0a4ab998791e6616adabd41986a1f7b6d4c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
56bb8760d920c53f1aad58a3ac36e835

SHA1
e936d13945d791ccb0eaeb965209358783525558

SHA256
7416ac947e8c5ba3b4384f84f6a2eeea017e6a1336fccc639d1adcda24718f07

SHA512
a2890b519ba780942b8cd889c7c5402b5a15c9a156427862b03dd768157e99d0b85a3c23609ca19b5ddbf7dacd36095320f151ac8ab8baa3c481911075b40ebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f7ed.TMP

Filesize
1KB

MD5
810aa6420dd7323182f715c3f286acf0

SHA1
d7770d9f28c14cdc44afd9d78be8e0aeda0a80e0

SHA256
3088bb7b3196b7b6b07870a2a8de45a9d895ba88b83637e4e11e6cb62aed360c

SHA512
ee60dc747ed308b203969a4f75b9eda61780f0b78b453e4a00a59c7d5a052801031be9246065d6e5ebe8e642ef9a592eb291a0e62905d2ccd41364d73a18cc7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
878bb67fb1e0a6763da657302aacb377

SHA1
d66a6b681a3059b4841214761ba359a1a749254a

SHA256
1582fca8877bf6eff74ae9a268e5f4cc14b63006084728f4b5e82980f59e2b2c

SHA512
a2c9ae9565f68f327b68916e42ced62b667366495ce388937fe4474ac0066f469a3bef17743f0b28dd480d6ec572518ec42370c67b685efef6970f229a833ae7

Download Submit