hxxps://survey[.]euro[.]confirmit[.]com/wix/p434124889757[.]aspx?__sid__=5-z-R40GDlwVN2xPT9-jTdtGd0C2QuEXtoF7uuFBLMbq3Ukc3Yh4v_n2Y8BmPJt3CD7KrsZdeZ0vpEsgp-rRlA2

Analysis

max time kernel
68s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://survey.euro.confirmit.com/wix/p434124889757.aspx?__sid__=5-z-R40GDlwVN2xPT9-jTdtGd0C2QuEXtoF7uuFBLMbq3Ukc3Yh4v_n2Y8BmPJt3CD7KrsZdeZ0vpEsgp-rRlA2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
1112	msedge.exe
1112	msedge.exe
916	identity_helper.exe
916	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1540	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1540	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4796	1112	msedge.exe	86
PID 1112 wrote to memory of 4796	1112	msedge.exe	86
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2228	1112	msedge.exe	87
PID 1112 wrote to memory of 2288	1112	msedge.exe	88
PID 1112 wrote to memory of 2288	1112	msedge.exe	88
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89
PID 1112 wrote to memory of 2812	1112	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://survey.euro.confirmit.com/wix/p434124889757.aspx?__sid__=5-z-R40GDlwVN2xPT9-jTdtGd0C2QuEXtoF7uuFBLMbq3Ukc3Yh4v_n2Y8BmPJt3CD7KrsZdeZ0vpEsgp-rRlA2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e8b446f8,0x7ff9e8b44708,0x7ff9e8b44718
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,18255003662443356494,606227729641322866,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1868 /prefetch:8
  2⤵
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x2b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b8642ed5a5e0cbfc0ad3cecd3bf3be53

SHA1
a446ba1544a52dc4356dc0c528d915401314db9f

SHA256
e84c33a8a9183fcad2b17a3c44b8e2394f2653b373200658b9cdd71ff719a384

SHA512
2b8ccf7d38fe5d0d897fa1043f0a624388e9b24def4fd3ad95fa80160d184da4a164c1ba9ae2498966a03aafe65d0025e49160532dbc6ae3ea4529c1839890f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9e04b6318bbed9f871fe49224f55d577

SHA1
607f5b69ea56aed7f9d8fd9a2d1801781d4ba493

SHA256
0ee4f10caaea6149d93ba206cb847b696f57143d04b5de9d84e7aa9b4f446f42

SHA512
8e6457cb59c080ba5b442018400c9414efbe944fddffe2c5fd1032d49312853d4ca86ba1c1bf42487631fc09b8e704f4da08cdc016f928781db6fbabcde7dc8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53d4825c0910ce7e7fd9a8bab244ca5c

SHA1
30339dcd192c04926eed9b946629b0bf17158789

SHA256
a9e39afbb0a9c472b6f9aed7b3488886a214e69e193fed0460473c2dc19a9982

SHA512
2a395a4332b32651b82ea546112345c3672d08fc8483d229a76ff8c441fd20b28cbde0986f992aeadc2c32675bebdf3edde3b137f1bc6223d190afb589e8b768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4039c4297e4a85d53e2657275711b548

SHA1
257309cf17391725db34c18897218160cd79f963

SHA256
6484318a44c04d3da4e68f60d6ad88b4be2d25b3292375c618b2204a39d34585

SHA512
d3a8151d203ae3046767457f9c758eecb77d735aa3c3125ec30954fa618cc38a33ca3bda13be56eaa6fa79626bf9842c4ba64baad8f4fd9882d318ff89453cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2602f09140fa4ca94040d921dd842a44

SHA1
d0a2fe03a81d1e00d5e1c072916351a61f227af0

SHA256
af8eb081c2be7b9ca2ec4433472665bc771dcb0b5d4674cd8b52afbaa0e99060

SHA512
1d12595cc4fcc52244554412ddc4d67ed9337bf35214ebbfa007389f1af5b5073eb6a9b8b5bbcaec72d6c2f53e8eed1cc7ec71ae562c74ed7e183ab42ab5d62d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d58a07a447ea05cf8e3ee8c0a5b327c3

SHA1
f323d982fbaafc65cda373a4c0280a42fd99038e

SHA256
5f9fec30312467940c7f8d674dc15dc19bb28f5783f872d390ed49660a787c63

SHA512
80365b380cc341b0e83e08013bdd2b662fcd1dead0d91ea644bd867334a01f711d814e1f579087bab9063f57fc0118e32de4204480d69c81f72591ed3ada02fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a7a5c137ffe58924b3c04fafa7cddcca

SHA1
24d4d486eb2728907f8c5f5f4b81f6715d9debac

SHA256
6f1c0f73d6adc55c2e3e11481c2edb1830ab8b52d2a41f7ca816a9bd836846c7

SHA512
73b01138c8c356901f4ccd6517eddbd60278984659c0f82d9206b467dd77d67728ad4c4c1608a5bf1bb9279631aa9b79916f59d85372f3c7cfaa4ede1068c553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
f625584bd42b57499abb51a449f4f3b2

SHA1
a88db3dc5d96896fec864552e02e2b7cf1fc2e35

SHA256
e684dc2b3179ddd02c6c6e0e323d536ab5d2ca734459e071fc8ed1644f50e75d

SHA512
aa9f222df1c95460c2c7557209b8823aa61c5179d41704b3da42038cda3fbbe3c8db1c19a3fb86287b575a6e7b3198979c536eea5826b284e31d2b49114c020a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b1ce886cf6b3a5ac23f60f7070da7c2

SHA1
fd2a5941b85ce5c7b10051f4d2c9375761edb0e0

SHA256
e053229b573ccd0375ee79d2af47e3a843b2dfd02a905636e47487366918dcfa

SHA512
98c6c7e3e4d8d8e3d38f9e70b541c5bbc176001f1c0c93e46e30dfff42e82ba3ac61337d31a365c72da9d3f4f0ad76dd3e50aa5e63fbdb3354930bc9d1f3dbb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
a4e258bec88b4b495f717dcb81f957e6

SHA1
938884b556b79879cec142b1d23004134467b4cb

SHA256
626a048fcf87dfd06ae07bd78d3b6f240a4b9e3fc7f9b10074b44d720f5cafe8

SHA512
d9605a41f58569184cd5c863e596f4322ec5714bc9e4ca5eb400c1b6fe18bc9b0536e32053f941596f25b34afc611b2f44da08de5809e199b734b38b1a8f5e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58196f.TMP

Filesize
368B

MD5
ad993b9f88f01e087fe252ceabf4db34

SHA1
39feeb9044fbc9dd58336dfd6fb25da3d1b29b9b

SHA256
31eb9c49d9e1fb06f90fa33dd9e09bdd984337f7126aadcb40a21d3c30c0d817

SHA512
2f788ba3f2112cbb8565cb5c4194c911477678880cfb108554610bcbd27a09c88ce55a14352242029e0c9eacf099dd9104c78c0695ea9efe6d82f92230cd2901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bece930dc27e6327836a94cd60092940

SHA1
6e206c5ac8930916f28438144e609556d5c3f10b

SHA256
dc0a1eae7d02ad256f32ff7281e923b947aa146c6873192977025f0a08f97d55

SHA512
b18ad267ec1d5acc42c4b85107f208f4b0dd854f79775e4ded4d1f2c22af9118af34539340fcd56bda73e2c720df414d451f37bac75bd0f1e87d919a2fb652b6

Download Submit