hxxps://twitter[.]com/VizientSouthern

Analysis

max time kernel
145s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
20/08/2024, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://twitter.com/VizientSouthern

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
3068	msedge.exe
3068	msedge.exe
2948	msedge.exe
2948	msedge.exe
2804	identity_helper.exe
2804	identity_helper.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4504	3068	msedge.exe	81
PID 3068 wrote to memory of 4504	3068	msedge.exe	81
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 2964	3068	msedge.exe	82
PID 3068 wrote to memory of 5096	3068	msedge.exe	83
PID 3068 wrote to memory of 5096	3068	msedge.exe	83
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84
PID 3068 wrote to memory of 1564	3068	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/VizientSouthern
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff16243cb8,0x7fff16243cc8,0x7fff16243cd8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,8327172642697000147,1496143561922253859,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
78067e424b6b422db3786b30cbf873b7

SHA1
6f85ffa15ffe976c788b45642b9f0429973c0f35

SHA256
5b9b891e8e95bcab8dadb8ef694c5fe85a1e77a94a9d008b6223e6b2d47f1f6d

SHA512
10e1ee25f3cc35ea94ea829371a33a3eecbd1f94113affc36628c498c483df7ea9a9834674c867d21a4200245070a69d12caf5c9b791c3e98662d05e1b927cad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
52fab784456871c7d6039fccf69794e3

SHA1
f13d4544d7ec9e3917dd002ddaf89de38a4a7ea4

SHA256
f36b6e0d7e2955370e9a305eabe8b21fc5c621bc3971cdfd4366a37d9cceeec9

SHA512
06ba0f223734eb99a1321e3b3c9b7672c35a86c54ca7f8f03758bb44f0437dd12149f148486a0059aa89fbba5cf86a0500d7cf691ba0ec93dd06b9f85fe26309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a2f7dc1f308965b8b4d1fa32a19075e5

SHA1
4c2054ede2a4648261dd1cb37449b8ac139d3dca

SHA256
bedf6408c822ce7485fb1a70ea339267ce9781e5f262ddf6db5dcd07cb1cb963

SHA512
8f6f5c59634b95f347a1afcbfb0f96570f8986645420baad8fdaacd7ebfa31f8104104566cf113defc3f6cabb0c9f0de94b74101b88a74472cb41bf786a99303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
10c8d09443b101365e8ecf5b6e15eeb8

SHA1
9c8a0426c1f163685df2f3fc541c9577a51f05c9

SHA256
25c32f0e67517ffb1ffd69606a36dc4926cad01d74b74e9c774bf084092a2e2d

SHA512
db4df8d6e86b6b8d3bdd84076469f01a340016895cba6ba7c1b95f8341979a2b274a3eb6cb8b385b477d16cf02e821a3d57963d78bfe82ced5b311fcd5d00731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9677b0559458c9dec3a48bc5c90d618a

SHA1
cdb6ae65b883669c7fbb00656a268ad5d4127be9

SHA256
c70851d56c97ab37aae9904bc92830ec7550177c1ef93fa391535ffd7458f041

SHA512
29a440fed775c74bda74f7cf5c5f7f03c66cb9bc89570c29a0215f7593b130e176410e6377d00ae39a86daa3e5276caa9a8818e7af31e04427cdea27730691cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ecd6f9323d58ce5487033a8be9b73cbe

SHA1
55e064a832b0397773b91ba6b090f76d0779f1e3

SHA256
fb2da3fb654e1e73ddd0aedc9e9244927ab8b71c16a36a6b5cb88b9e8bbde178

SHA512
9edeb5e621c058763b8b436dcbd8133dede033c7cea6d8ecaa3d605c3f261b32ac9debdacc98a204d402a4f115df2014ce5f72c070140575a6829876099c8893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43305ed5ca2766e2f9d0abe907567281

SHA1
49d69b00aa2469f4fc4a69041b59130a64ae003f

SHA256
089bca96e1309be933886d10905827b5aa875c79297273935045730e0e1d8169

SHA512
3189670047bcbaaf043f0b272513ad12d980f384e048414a29b4d41b08aa44afe6486201183515cc7f178a394e2855b45a59e828cf91cb519826e9c14fe72d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b49b9caa811cc416499edcce8c4610df

SHA1
a0f59eaa8e1619e6d3963a642c3f1ff9f3e7dfaa

SHA256
18b4f12e7a71a9d1e7cf5ea707ddfa3c1153d6903ebc5bbf3cfa352ada2c247b

SHA512
199f7d3e667f87bca4b24b6936e469c0df098bafd9b4286d26031bca32185758f37e4acf10718ca0f2e42697fce4c67ac7ba100023526d93db5999768796b7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa5e.TMP

Filesize
1KB

MD5
be63d4074a176414f805e6befa9b9a20

SHA1
309f973480aa195236a1034453566306e44ed237

SHA256
321e1244240cbdaf9adb807f3429ca0098fd543b8a39359827b59c716f9f5d45

SHA512
41d21190d4906c051b8c36ca61b361cb6b7a2b525a9564491e8ec6a0c7d46c353372112332b90661d169c0d7e54167c2ab9e5a7ad0539a502dafe95817275c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1de4670baaecf88fc1f52d20d1423ac3

SHA1
6895eaf2fdad429e6f298e6b2b76dd7344b9b75c

SHA256
47c570218c4f9b29ad7b214c554c061c4b83d64b6be704739d8eb234c516697a

SHA512
0567e3739df466439d33cee14919c1649e420c15febb010dceb9848827c772fe6e22ae3faef5272996c865a6a0b22a2aedc72c251c68013b3cfbe3347a8b4ba8

Download Submit