hxxps://moveitbdc[.]fisglobal[.]com/human[.]aspx?InstID=1446

Analysis

max time kernel
83s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://moveitbdc.fisglobal.com/human.aspx?InstID=1446

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
1676	msedge.exe
1676	msedge.exe
1492	identity_helper.exe
1492	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2740	1676	msedge.exe	83
PID 1676 wrote to memory of 2740	1676	msedge.exe	83
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 3216	1676	msedge.exe	84
PID 1676 wrote to memory of 2756	1676	msedge.exe	85
PID 1676 wrote to memory of 2756	1676	msedge.exe	85
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86
PID 1676 wrote to memory of 1448	1676	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://moveitbdc.fisglobal.com/human.aspx?InstID=1446
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9f5746f8,0x7ffc9f574708,0x7ffc9f574718
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8940953774925022759,6301910572909185501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
85672f0c4613fa15ad13b12bd642ed2c

SHA1
1c0abf365d81e0044925e5850ef3bcb0dd69218a

SHA256
ba19cab34a35c0c68d6a209f6a5bf7666466f32c7cf8efe33df3c3902d1a16f5

SHA512
02dbb7db71b8e66507e0caa37398b96bd87bb184084e0a5fcac823c247401b1faf72e17b0c13a37f56a571268222faf29eafd9aaa237baf341cb476100dd70d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
5f65dbe2fb23b7ed5ff851405b03a070

SHA1
c0d244f0bcdfac0f282c67ef981521f2a570f0a8

SHA256
066b652167cb8ba82d5ea1be391604a49d380e9ead7a35b51ea07bd96e419c81

SHA512
94468de28466c4d69a0b2230c5a24bb6158cfd139c643d6f4679fb19e3d6d8b10a9d4adaa73313e2623a770a6924023e7c30f7228467e700c49ee3f6f03aeef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
271B

MD5
12f8fcdb4a2dda755d89f98ba5e9921a

SHA1
7182bf4f9f343994e7f51330a56e2871542bdda4

SHA256
764dcb52d66105fea0e38ccfc4b133f6d8e34e585288ce68726d33cfaf6c178d

SHA512
3ffcd1b167e43a4c851a098d3a592f6ac792100288c01c23743e506dac283d46535ace0da789cb9935d22843ff722b51d2db907e07db0038fe6b2f15fb2d8281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cef1be9683f42b1ea3006be4c63c64f4

SHA1
ff8f902f205c653b615b3ea0b8c8af55d92905b9

SHA256
46b987531c4bb106a6e1b676c7e43f342805aa527587522c604c3d0d79dc48ba

SHA512
648fe73c78ee654ad06e2d8ec55fe8f43a777048acd6e413773d8ae8444e30ddc48ff6eca702115ea60ca266e0d5de36508d1e240d77a0f455f4aa4507f4d7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60a0a8b5f0983e65c2b5f00ae17cf5b0

SHA1
aa310ef027f80e0222e150b2b5ed5de3f517be78

SHA256
bb158d054fc8388c098d3a0f978c9026e4f26139a1fd1808e0a40b08453fa12e

SHA512
fa3c0b91c3986dc12b470bea57025f52962dea274a4ad068c748d540eabd53549aa2c51bb153a4cc9a6e03a37ed4efae119c5d9e87f4bb0c8f7514adfedecbed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fec971f5fbe19137b3d57cb16b37863f

SHA1
4bc2c832eacb94b2ef5497b5c8a10328db368ca5

SHA256
9093282264f4f4f83aef8c6bff74088c793fec86e6ca6acb7be3c180acf99c2c

SHA512
b106d2c49baf4318a4861df1fd2e77844cdbf7059157c5586d867ca21e2d14127d58038f9e454cb225703bf60eead75450689b8ed7297adabb8177396c8a7797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4275b8dbd89147b5c1973b5eaa49190c

SHA1
993fc210987cda648c9c96f087900be1e7432f6f

SHA256
2333e24594a3a4526684a2e0ceacd7ac05e35650ce307ab6471cf27d8bdad9da

SHA512
e898463391183a9870b68c94f4443efa73afac2fecafbd14545d25a29aac805b7d4804967c5ea7165ede9d5c6447c7ee21f3841606f9a01bd97e8c2a578a141e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
c3cc31bdd4895ae8747fa15c25c94574

SHA1
4959b0f2984b917dc977e900b1378fba5a13393b

SHA256
d34e024407e8e5df552e6054299797801b725c2b15be52212da60101212838b8

SHA512
aa0d76644b170d2d90bc4360aabed2269fe191a870fd1eed546ff6e8a422a8ca004a983558c1a047fd8bc3fafd14686e6fada277e0d1c4ed8f6ff16446b34cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
305efc238a6643446d5567b33456b8fe

SHA1
f7f2395e4969b7321b27ef391255e9f4c93c7250

SHA256
eecdb0c9596bd572d8330d8fd93f65face550bbe965cca294329ce177cffb74d

SHA512
1dd1a9c511ca6d58088a8d475028f78e9ca6ce48a7f93a25182dee02546c60d77fcf268f40ecd03bf0fab018aa0735e3af4546dceb0e7c7638ec8ac1ddea5bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ae6.TMP

Filesize
203B

MD5
d7f8358d8891dd18f9038f20caf47202

SHA1
b1c51d6e2cd4cb38a3ef42dca941c4195cbecd4e

SHA256
83b656117738c614d54058ac0706e177c2d8c7788a1d50d3cdc6fd7de4958f7c

SHA512
5f17503dc59187d67da646b2b54f3a087f407e5aecf4d1f49b5189567750ff6ff7f1ab27e1ee56384637916e21af954eaeb0a0af93f290000a5f278d78ddf6fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1318cdb4f03ec7b41d44ff443d642cf9

SHA1
826962141e234f3ac201960d0e1e461bbfe8dae7

SHA256
ba1fdbf9ba96f2cda2ec81eb2549ec0f66ad7029e77a0567c3e71fb5776dec28

SHA512
e25a6619ca7a9f2d21169dc305048f1b7b560107b4c56691d0917d79732d0209b7b4e36e4603fc06bd8b3ed519fc70020b49cd0a2b06f1a1c7f634910a964208

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit