hxxps://smileconference[.]us17[.]list-manage[.]com/track/click?u=fb4cdd97285db8d2cfdf7647e&id=31e2508403&e=deffbe1a4a

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://smileconference.us17.list-manage.com/track/click?u=fb4cdd97285db8d2cfdf7647e&id=31e2508403&e=deffbe1a4a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
3008	msedge.exe
3008	msedge.exe
4360	identity_helper.exe
4360	identity_helper.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2584	3008	msedge.exe	83
PID 3008 wrote to memory of 2584	3008	msedge.exe	83
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 4316	3008	msedge.exe	84
PID 3008 wrote to memory of 2224	3008	msedge.exe	85
PID 3008 wrote to memory of 2224	3008	msedge.exe	85
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86
PID 3008 wrote to memory of 3384	3008	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://smileconference.us17.list-manage.com/track/click?u=fb4cdd97285db8d2cfdf7647e&id=31e2508403&e=deffbe1a4a
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c9246f8,0x7ff84c924708,0x7ff84c924718
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17407830464194759517,2834362382160144885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
83153982740ed7fc805c14a47162f64f

SHA1
372bc4678e60a82cac0732a257f9ec6ffffd180b

SHA256
f99a09228aa8daaf27af48ff1f6ead247503d55bfb56b5525bc0f29b163f8c05

SHA512
f3f1f248baa0fa970f4d20eb0606a6049e9a36c22a5f40adaf6498b7833f6f16227c171463a2a8f39f8202399f0a1f9d0837292f0acab98cdad4dc0c15a5ab7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
8c098f895705216e8fabc4b2d444482c

SHA1
3a0265a836eacd2dd7fd3010bd6d21b8c151dbda

SHA256
7b72ff11ea4ca31e1a80eef7f5109ad5dfa526707e8b4dd7e65197f186a29faa

SHA512
0daa04186e7146aa56f07ab4b78c5d2f82c62998d870a26d5eefcb3156f310555b30bdc29d93dfdaa145d389f2a0ab228f68098afd7aa04c6e27bf351141ab60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a5890ce0a30e38a70b5ede47394c9e6c

SHA1
fe275bbe124cf1f415035ade293925fcb3e0144f

SHA256
1c1f444250c99f8e1160789c10e9a3e17c67714a992e60076b24780059629043

SHA512
a24b2131866d230b634d99354037966d41a2681acb58bdfb2b70248b323649cf1ab5a39b55e6669be77ef2d091779d319e999697d6e03bccaeed349c0ead4ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56b615ea3016ce9d4d44e61ee76a1b1d

SHA1
75a79dc685bfc1538f03beb6be3cb8b93147273b

SHA256
661145d510d499d0b026e19be020ad3b6f62882cc48c5d5de0946abfc5c40cf3

SHA512
23a737f9b3ffaa25c809a6c9916a2f99369af5160d1efa3468332111da5d6ececc0c6871262b22e1ec7f7a710ec36fe60246b70bb8ad305acdbfe3101d859bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9793c564a487932dd946dc1157cd91cb

SHA1
d1253815f7c5ea7194ba5175a7681cf6404ceee6

SHA256
2fbd677984f9b8aef609610f281ebd4757a10aa7812aa8be58a7ee28e2521bbe

SHA512
9cfe85459ec0a64c10eab569a19de3dd1fc1a9509afc59e7e2436325efe75cec6ea1bcaa208c97be42431a14442cec60420452b65a8a253f77e5abf429c3a3dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9560b76ca97ea43a2ed796a06228b0fb

SHA1
b8c5e5f15f3f02fd7e3071a42b5f4a6a795eadaf

SHA256
b6d09d681ccd8f4d22fc21ea3d0cc1a1ca12d62df63b94bf68ddae813d817516

SHA512
8884918da1042fde7afbdec1f3aac17944e38bf4a685125dc354b1c3f10789d9aafb9bc182536d38f1fdd95d6a89d448139b4d4add04144d645e2749cdfba845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f31618b3b96c8a7a64783b4f8ba2c96c

SHA1
16df542c7c2d057d6d2b14366ca1e6cc043cbd4d

SHA256
0bff0dc9d9b0a19d16703620fc48c96098b42464574a54c993e8c97d69e8acad

SHA512
425573e7290d85c5fee8cc64cfe7a952896bb5649f74d2ab3d8151584af310e6674405eb2832b87e754811e4360d1a3aa5742311997d2110357927e012b387d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58486e.TMP

Filesize
1KB

MD5
13befdba033e32d13fff28e09f4b80d7

SHA1
0edae9e8a0d4bd8639c4f611f643214db9cbb26e

SHA256
3d0397047472e5b561a99b96252201327da450b02a937b1c7dce67f0b5e427f2

SHA512
091c52c60805e28197b4db1f02a7d4030e11a439275d30aad4af6038c693ddd31fcd065d7e7480891ddd7b2d78914c7d4fcdecea26cc7e4e3fed30f3fbc3cadd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5cb9acd4022ec31cfe30b6e37abdafb3

SHA1
ad594916ab31d7daa42dce5c3a012b6332aac257

SHA256
dfbf5b1c66e7f5aacb03436b62a2a67cbd19f799665b29d3965aa574cda11f9d

SHA512
d0288ea761ff79d960c495f30c8117dbe91d8cb0a51a96d984b473d0065878561103b5b21f2d42b72266a80c1149bee10659e299677bbc43d37b384a3bb5654f

Download Submit