hxxps://mediafire[.]world/data/bhgu-oloki-hyggu-uygbh/

Resubmissions

29/08/2024, 15:44

240829-s6vj7s1emn 1

29/08/2024, 15:41

240829-s43g2a1dqq 3

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mediafire.world/data/bhgu-oloki-hyggu-uygbh/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
468	msedge.exe
468	msedge.exe
1072	identity_helper.exe
1072	identity_helper.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 3312	468	msedge.exe	85
PID 468 wrote to memory of 3312	468	msedge.exe	85
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2748	468	msedge.exe	86
PID 468 wrote to memory of 2956	468	msedge.exe	87
PID 468 wrote to memory of 2956	468	msedge.exe	87
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88
PID 468 wrote to memory of 3528	468	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mediafire.world/data/bhgu-oloki-hyggu-uygbh/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9835546f8,0x7ff983554708,0x7ff983554718
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14724548671374673042,9672078663975853992,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
120B

MD5
c433039acbc961248fa7f47c71b63513

SHA1
0d3babc995cccde7c7322bb3f6ca090338d255bf

SHA256
69f54dfe939b84ff46c80e04854c0c8b88e8dc368ea36f234dbd105aa080974b

SHA512
0901ab106feed8216de54cf517adb515f316c5096ca860cd31137f9c8eae7d94e6baf8a434cc05535bbde30c20c44835990c0e9f58af1f3c06540a3cce1432dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
8bc28ec75bcbdad3737f4db28d32dc5b

SHA1
be98d77fec1d818e3165cef57996046003504b6b

SHA256
3b17e2a4751a0548cfbec165439873fa3175ed74047289b30c595fdebc2c1a55

SHA512
efcfa9d1d184cd3fb1b51da09b261b6211f5f6db29c92747010f98fb45d178c0f3c521422ed8125e20c9f8ee011f26b044c2509c9ea89e740515d15828a71f5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
45273f5b4043eb981ec085f7a492b6db

SHA1
76b08cb33317d8e794b9a1d0ca1ee37b05277ff6

SHA256
812d553f15cbadb0e75fb5e76a47ab76436bd3675068dd0155897fe67fbc3713

SHA512
24ab297a100350bb1832d702bef73b7288fd12c0c9a95bf6982cebeb2c7c8c0606e3ee128cdde0ba1c936c411cbd424bc10bd34c549c5b76daddfd941616103f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
888B

MD5
0740092db05ef7611a63a03e792b0a4b

SHA1
053c018bf4461a7e6c7422c318dafc7bfc712a79

SHA256
5e055e6fabac2c26ce064fa674ae7ec1c4f5a314a8963b5902b17d6c7e8af8db

SHA512
97d94f0851d9ad64cfb6b73dbea108b0a8dd37b07e1b2d8a3d02b73de5be21b1acd1807dbb0faf02872f43a019d334cc4bb6c04e4479f169a937f1755afd573a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cdd3600b20af61083e6900a30c4676f

SHA1
5e5299e95048804e922919978916701c44647394

SHA256
13a0e148c5f8a435ce069d3e94cefb665ec67f15285ebf6158cbb12365267634

SHA512
54afe9cc1149cfb69a171990fb245ab52fa5e5ef9c73d89b3fda1fdd1ffad409bd76280cf0bc7be234fe95e319d23acaee7196a9d14095e5af5deccbc32b1166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
532dff7a4f88013068d2ef725d8ca830

SHA1
10083ff821ca5976568b1fb75a4c941b6f52026c

SHA256
6041e274e445af79aa5de96cf06aca25a20cce1d395682ba97f957f2f8a6c9a0

SHA512
a39fd0fa21b5548c34b8b80eb7ede9c1abeccf9675ccd377359d3ab2097c9c1b1fb0406a6a78d684af74aaae79417289eaecb7a8ad27d4e3562cd9d94cfbbe49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b57c5cd6f225179ddd7f2be29faef1e

SHA1
2c267e1a1d513185a5ab57c0e720f12e8b2cd99e

SHA256
d0ba7ee804254819b36be153b27c4af0953794e8b2f7dd29191660abd42e7cbe

SHA512
954922916c3e0a302e92cf01a74bfad6bc0b26feaf8108fbf86eb117115d267892e6f9ca5d5fda87abd48792d57d928d4bc7cb96dc353c41ce0eb412cd3927e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dec980a63b568c55e8a2f5dd19b016da

SHA1
da777e84fe1b054e7adc4cfb02e9f31bc65cdc69

SHA256
a180aba6944d2a951641743be0c0051fddcf8add836ac5c60dc43c904fca7f91

SHA512
4e5bee126efc704cc06e988a1af9332182794a41f449ed5139f0dffe0ebaff9d292e36d69d04f878d22215455dcce726742a0ccd57143d8907cd13a0732cc008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
e885604a4e1ad2915867678102fcc9fa

SHA1
c96937eadca03311d7d694d8edde575e12208a08

SHA256
ae2400db12d554b6806f4331381abca8eabbde96dd3918f108df694187da24b3

SHA512
a4a0e1e53ea52e68caa632e73d95988c023c58944aedea0d5bfecfbd4165a7169484f676ca9a16cbefe7bf825a15274162323809f5c51d23eefe3d2034606ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595f6c.TMP

Filesize
204B

MD5
9cd6aebaaa4c07c6511ada25205a5446

SHA1
b89f48082c883e0b3c244145bbc573004db95845

SHA256
632478277c1be579a5bfcce8908285cd1a701427a11424f1146ec310cd1e1bd5

SHA512
c31019a733f76705545583561aa221060a4947bd9a81a4a74ddcb335b19f855cae7d44adffedb4dd6eabd0b65485dd15d87f60e74727c9cd52281b99e2905c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b13482930702d1a60faac5b0ee5fe08

SHA1
9f4f00077fd7bdd94900d7f17e5bc1ae0fc1e8ea

SHA256
77807c259be3afc7921930ae7201fb5421d9f573b828cb5c670d6e0a535e13c1

SHA512
4085511c7071e03587cd5cfc7eef659563186bf1d3b581d6dbd7d2d0a3f8c6a5b435da6619836ab0ab44212b239b87d2e5529c3cde49385c568faa0acfbd9c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
681873859e3772f1764e34e6cca72357

SHA1
a70bc843ec05f7683080daa3860cfab6b4d67237

SHA256
ddcf7b5a7ff2c1867711bd2919f0d62c925e2204e469b77e366878cdc6022d62

SHA512
75819d200cf3488f73183371324f3b51c84e6d2e0b733aa44322f1ad43956b850e7285bfeadc20913310ca936399ed951bdca4b3ce66b738494dd44edbb66022

Download Submit