hxxp://mempool[.]space

Analysis

max time kernel
159s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mempool.space

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
1552	msedge.exe
1552	msedge.exe
2568	identity_helper.exe
2568	identity_helper.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1140	1552	msedge.exe	84
PID 1552 wrote to memory of 1140	1552	msedge.exe	84
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4004	1552	msedge.exe	85
PID 1552 wrote to memory of 4072	1552	msedge.exe	86
PID 1552 wrote to memory of 4072	1552	msedge.exe	86
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87
PID 1552 wrote to memory of 5056	1552	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mempool.space
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a02a46f8,0x7ff9a02a4708,0x7ff9a02a4718
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2344,4047023271097108498,5413599075415701806,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
f66300024dbadbaaf1a9b32118484f5b

SHA1
42c5e5ca2f3a554a3882653a8f1c929f79ae5bd0

SHA256
5d74c0592230ff0d6a64666e2b9b9b92369b89ea57acec57fa9a35a3bddedbdb

SHA512
c8090b879c2829f65c87967beec0aec4edb0e4a0b7765aec238790c3791657c6e19d773ff3932ecd9e31e95dd052314c1ff3ea34d6b1c5b7ecf427dd62fe2720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
d1e1e5b4956d686a8e28952d8fc2caab

SHA1
ff6cbaa37cf479481a7e6186bf7c109ac18d0ead

SHA256
860b14fd7770d146239f0c51b2f16ffd039f4c6418d1933ca6d4a4b65b1228d2

SHA512
6f7255044864715969ccd6c5f2701d0ae3c40b8c87c9171548942c8242a38fb2e48eac6ed716829062912a896a6224595795a40b04f409ed142ed5d78f6605dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
99b57bbdfeb38dcf9ec1d66effb58a02

SHA1
cfcd28720e6ba737faf2103c25a4f1406eeaf0dd

SHA256
fbf1dd4250940be6a4bdf69fd5ada1c89deff75a9af27d9aad37c2aa1984f55f

SHA512
51dd926f4f644611892fa082c4c15d145731619c25d2887f2a87f818daa53a85cd67cb93af62a0d15b66c5caa638553afb1f2576306c27e61b5dd8e816d988e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
58064939bcee84565e9e831c2682967a

SHA1
9d27d417b0640b8421a02696c3182c68a6e5bdfb

SHA256
dfc57efbc9c33a33443bf168ff6be3432069692efd1c523e8f5da45b57f4cd43

SHA512
57bf1dc4976fd8b0e69899cbd0872214e027913b0cad431ff8b4f6a25b9ab2e79103fa778508827ed61eda2aad9f744517b3a75fa483b6cabac9a96e0c0253e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aaca13b9904d097fb0f45467d9a785aa

SHA1
7902b446a35b535d2f213748db22b41a53216967

SHA256
86fcc3eaa9edcc0e37fae12c25fc01e7c2f8b5eb0538e4c1f49468f46805ce6b

SHA512
24c6fbbf9b96725e748416c26195d38f9d3fec8d2e99beda499f4e546c746957025956f2507ea851ca9245bcbdd9dc2480c2848f569baa643248175722d0cdd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6cbd5165e62cb0327dfda7954cde3a2d

SHA1
1dd3604b13ffe5f3b3738960d8edf1da62aa56ac

SHA256
4b7357c31db9ae77aeba401bc6d58b664b72c886f6e00b38690e2f0e161aac3b

SHA512
7e2c1c83916236e52e436986c4ff356f331db9bacaf1d5d427e7f2ada7e7bdfd5105f0dfefc4fc45e85ef308280adbf52e000aff3e0854281bc8196e38370e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
dbd8e18ca742fdc1b6bf6f43a5a1efde

SHA1
34a1d2882f7463e23b5dc7b487ab55fb36cdae68

SHA256
01d3b9d9fc8c1903d0d1708dc5c00e6fab64a401b8c5ac71419cb69e8cc60b7c

SHA512
cb61d6e0e87d753c5ff5d4c705b6c96a1ca298dd221192692b83adb0e45fd0367b4c92a6445d80fd8190aa817cc76accd4e79a848c4765f305e220dfad8962ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
41abfffb19c6364fee9303a9e334c3f7

SHA1
0323b2e92b836216384fbee3fe4cc0647e74d7d5

SHA256
2cf5c7055605a40006dff29d50ced057e306b1f32213b56a834d6da344e1bde2

SHA512
19c47382a6c0ad83952d8f229f742bbe8fea7bf1fa1003dadf5b2b75ebd61f823e92d15d39aef5a295f5717737d22b04f832e79bc24cc400167c8e868318d1a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
a98068b0f017f879fd2a07a0fbdba287

SHA1
c12ac2cc02e7ca1416981298a8f5a73484fdf7ec

SHA256
9631d9e6cec53e85b1fe91aa9de99505c7eaf7caca1895f310e6949776600b40

SHA512
ad342b813b22b33b7ccf520e9b79ef90bdc04ec3d14a9387bc23530ca7b8796248bd6ce88132df95390075fa0aff16ee10b8703107f83fa865d31b4cca14fffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
ae517d6011301fb1d23c38a5963c4061

SHA1
2031b2f12608e6e1696ffa7cd139be7852eef181

SHA256
e9d4a71e818ba4604c84083615125cef4e1d550b0e37d07bc31b3a5bca4d4de5

SHA512
a8b311292ded382ba47db8acb2231365a91f0f34f29ea519a249aee09d38b93a58ad1c2881b500925eebcc7f0fffdf70f17f031e261a2dc51cf360da68f60542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5839e7.TMP

Filesize
203B

MD5
553d15fc00cd688aa5bea4a0d8e445b9

SHA1
a6d8ab73618acbfdf9123bcb0465600cbf26d07b

SHA256
fd7ebc43f7c6c050dfdaf206a2c49d21ba157cdcca30e7b41b6b8dfc8be04ba1

SHA512
78f3a58a599cd26996e62f5959427e9628244a7e6143d699622d2d17ad467da3ef86bb911e3a61ddb172caabfb65008bd7a0ab658bde3709756cc8d9bc07c1ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87b1d7401274f68c08d9e3479bfe07e3

SHA1
12da8e9ddc1e42affdb6070a0967a64ac4c8ba18

SHA256
fef164601266c063640afd14b70a632e87461f54ebb22dcdd8327c6168373b0d

SHA512
47efe0bc84ed7f7ca3053f20192e641969ea1c29d0000c333a62fe600fdf80d7493fedb4a2272bb9469c9794f643e1d69368e0f000c1941ea32f1c9ab2aa4321

Download Submit