hxxps://www[.]nbi-sems[.]com/Home/FacultyCourseInfo?eventid=99611

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.nbi-sems.com/Home/FacultyCourseInfo?eventid=99611

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
2536	msedge.exe
2536	msedge.exe
3448	identity_helper.exe
3448	identity_helper.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3408	2536	msedge.exe	83
PID 2536 wrote to memory of 3408	2536	msedge.exe	83
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4516	2536	msedge.exe	84
PID 2536 wrote to memory of 4148	2536	msedge.exe	85
PID 2536 wrote to memory of 4148	2536	msedge.exe	85
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86
PID 2536 wrote to memory of 3680	2536	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nbi-sems.com/Home/FacultyCourseInfo?eventid=99611
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafe8546f8,0x7ffafe854708,0x7ffafe854718
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,482665220662045936,5765551174551587719,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
8a54e52c357413efb4c1f2704f4a90c3

SHA1
ce3ae7ab44f44a604a3732ae0a233e9ef357427d

SHA256
23fba66db3005b347dbbd72424eaceb7a1cf2e07f1e02abd1bb1a54301fb1c41

SHA512
daaedcbfb56160631a3edba61d24006d028e3d2a3a57dcdee8093daff3bd58433292fa495c8c67f3185367e6a71347967864eeb0818e5a15c0ae83413a55e972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
e34e1c6fc87867efbf25d6cdf18396fd

SHA1
b45b2dc954e50a326231d11122eb3e30cd18c53b

SHA256
ed9b60f1de297da8b655a5a21c1af82eb01c8d5ec03a96bd92009cf86d7d902b

SHA512
6258dc640484e2393bec1ea6a08f09b4baadd06502edc0d3bdad7b99cbb7774e2b277c067a60e45b11f654894b034f9441800638726ecdfd1711da66dd9641bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9f7bcff621976489221846afb894d99e

SHA1
b6686a299d175e3b17c3d496908b8280a5a24fd4

SHA256
a52a7c7a3e2918bacb3fdfd294c17e78b75bdb55b71cff25600c0d6854489a54

SHA512
ee4c330a18840f5f9ba1435f1995bec2ab3c5c142230783d98780c8774ef3bc4118a2863ab80fd470444fad326c9159eb5c5d9455797e657a132c9423f3dae23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
00356ea41fda248f2282fbc04e393e6d

SHA1
6ab379f44e55d86f5e829b9791f3d3a8026627aa

SHA256
c00ad3feaf62dc5fbe3497a3deb268580371dc0ea04b0e29d9458a2a75c895ca

SHA512
72492b4ecd2606c8bc66747e89e83944227310d79a4d8fbba9da91fc90108a6192e325962171359eabc914bc25e55bb708600612bb59f35b4dcf54960153af7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
723c921f50e2a47f8b22342e8794a350

SHA1
642bff0af63667264548c9c1966f7bffdbb91d6b

SHA256
f23d4de696bcc500128f4ef586aff58a680b81efe52ed9e0a3aa9dbd406bfb9d

SHA512
bce71eece29e3f03a1dbd6157afd3b40cb773d8a1c2ba6638a58d2fa0a6a6f6aad019991de6cbe233bbffaa6d80e3590c6a2cab015de30ce93f2388e119ccf00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7c3f4cfef231fe7ff63f08f7622a9f6

SHA1
346a5cd788a35d561c839e94f074deb342c9e4c5

SHA256
3f59140b3d0a0dd49d080eee26d9c23823ada3bff4aad66237faf12adc507eca

SHA512
48c3f69334f4b3c803dc2109b760b09d449a621d92a8fa5a75055bf1931d8f4dab6f4175d0488dd881134967bf246eb680e898dafb6c410002d7a323401b57b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9349bfa4065a1f0b2b2456076656fda0

SHA1
a2751a0566ca78cfd00217b534c5e772a0911501

SHA256
47d8b558235efc67c80472efaa4968fd643305964621693b8f735b813177e9b5

SHA512
ffb0654eadf0d64aedefa66718f5dead4bfa0848bf7bedf31d6fbf975a2a617b1b23ba0166c5352854f0d0c9845cb10a78ecd6c5292dc432679864846aefa677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4b4a1b1316b618e7086430ec6f3b5eea

SHA1
57d695990f235f253d63d75a59aa4b5b48895ddf

SHA256
9e67b84ffb09306ad0c055b3fd280cf669bd9b1e53635e2dc7a09039679e6c25

SHA512
e2c8934ee7d3983e4a83cfafbd69f556f1428a8293d2d9657b3043f2dd108d250de79d660e2c0bdf0a4cc4dc7b2a889961d042a5890d61d8eb83c597cffb0f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e69ef3915f28cfa6e58d687ccaa37714

SHA1
a8de7027275520dc73af92a4b029e439a9602049

SHA256
f07030224cd25268ff7f01006527be560d0e643ec06c1b93df1cfba2e56708bd

SHA512
431aecab3b91ee32835e8098ea93dd75629ad957d281c3aa27b47825b72d35ec1e2470a28fdb2b797df83f283d3b6dd35e73c49aa04bfc708088c311e79057b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
808a8bb0c9b084f83618693bbd53762c

SHA1
7c19cf1f397e628376a72e3150465e6a4562dd72

SHA256
4c8fa9eda1eb9c0c219cd245b297e88f3c91adcdb92c5716c3a8a1ea00c9b0eb

SHA512
e00870f8efd50f8d55e62fc59a5d3d2e5659dbd14b2c63186197a1c15b1723b01daca065f07219e0cd3f9cbeefddc59b3baed5ad4ad45429450b9294ea4c41b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dc5382ec67354e5f9652ac1af97842a8

SHA1
f9d8e16df560c4366ad30537bc55c37e76f1d7ce

SHA256
ce74bd8a3f636ce6b28f175f2fb3fae6e6ad3b275abe80acec0a60468c5e0eed

SHA512
5051168a37ea99cb607235cd8dad5be050a3d757ffaea7527c44cf70b34f7f7a26cd101554e1c8899bde2d6c060f1934d7bf412bc7ed2d14884cb30959a8ffcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e426.TMP

Filesize
707B

MD5
4574219f5e0d53d7ab410144fdfb68b2

SHA1
e7d69bf4d0309b562fd91ef1b2ed82e14e96d145

SHA256
db8ea978804f776ffa349a64e48798f9fa85fb4c5535d44cc3134005e0fe1f05

SHA512
cff6949c6d58ce56576fe3851e67c3cb0df9183114cf9aa62327b55681893b555d72afd81afcca84c119bd985f07b46c754f20e79db22568b939de6162bc23aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1f36b98-0790-4feb-94cc-cf0ab66176af.tmp

Filesize
3KB

MD5
cae25cc74cc7ed581380f07a175adeeb

SHA1
9f1713b1562afa14431657f7cf438d2c403af157

SHA256
f914a4f62117d8a1153cc226bb8102a5a582c295fbdfc2d7d9d0b1ca8f41d7f0

SHA512
7a74a4244340f99aef15e44992e5e3d2c322d6882f338748b30a4a795e9320f3b4335d65391d2b9011cc9b9f5be5ae79d17a33a8b06f407a557f9996546bf184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b81721c846a5e48c7dbcc5ed974ef3a3

SHA1
5cb04424edc99b9e0775d9d18cc469fb76e3b330

SHA256
d948a29d5c56ed2fb7ca3f40639a5748587104d7f6b049a49a6a2c1f42fb3fda

SHA512
fa2ef3424850e04aa6388b5719ed421e211e96ced4e579fb25b98814ff6b5e679ce5b8684ee628b2c5090e0b99c7876ec86d445078b38a2a449463c20caf2978

Download Submit