hxxps://btaeu[.]deloitte[.]com/GOWORK/email/validate?oID=U2FsdGVkX1%2bvu7vrWofAub3PzvZHc%2fcMBxEDMpeRIc4%3d&tk=yy8god2JIzAwJCxJ%2bW3sEIpBC%2fdryS8bgzJ8gEYULP0%3d&sg=s3BoYMJXxPb02NBpQF99FIK2ttkim1RGlQk5RcJ1W39inq6b988BXnlrf3a%2bpdpFcrVQ%2bvB3D%2bXS26iGbFpVPSpJbgOT9UJh5X88%2f2byNqcZPDpVPNUg4nR2LfqNXBkyR9IkntOQVPDYsP%2f1V70eHSbsDvy9OUUKDCdTxnc0QqQ%3d

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://btaeu.deloitte.com/GOWORK/email/validate?oID=U2FsdGVkX1%2bvu7vrWofAub3PzvZHc%2fcMBxEDMpeRIc4%3d&tk=yy8god2JIzAwJCxJ%2bW3sEIpBC%2fdryS8bgzJ8gEYULP0%3d&sg=s3BoYMJXxPb02NBpQF99FIK2ttkim1RGlQk5RcJ1W39inq6b988BXnlrf3a%2bpdpFcrVQ%2bvB3D%2bXS26iGbFpVPSpJbgOT9UJh5X88%2f2byNqcZPDpVPNUg4nR2LfqNXBkyR9IkntOQVPDYsP%2f1V70eHSbsDvy9OUUKDCdTxnc0QqQ%3d

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
4796	msedge.exe
4796	msedge.exe
2732	identity_helper.exe
2732	identity_helper.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3652	4796	msedge.exe	84
PID 4796 wrote to memory of 3652	4796	msedge.exe	84
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 3284	4796	msedge.exe	85
PID 4796 wrote to memory of 1236	4796	msedge.exe	86
PID 4796 wrote to memory of 1236	4796	msedge.exe	86
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87
PID 4796 wrote to memory of 1352	4796	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://btaeu.deloitte.com/GOWORK/email/validate?oID=U2FsdGVkX1%2bvu7vrWofAub3PzvZHc%2fcMBxEDMpeRIc4%3d&tk=yy8god2JIzAwJCxJ%2bW3sEIpBC%2fdryS8bgzJ8gEYULP0%3d&sg=s3BoYMJXxPb02NBpQF99FIK2ttkim1RGlQk5RcJ1W39inq6b988BXnlrf3a%2bpdpFcrVQ%2bvB3D%2bXS26iGbFpVPSpJbgOT9UJh5X88%2f2byNqcZPDpVPNUg4nR2LfqNXBkyR9IkntOQVPDYsP%2f1V70eHSbsDvy9OUUKDCdTxnc0QqQ%3d
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffacb846f8,0x7fffacb84708,0x7fffacb84718
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17660695308337353785,2695644819929101549,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
101d735448a47177e218ed18ee5d0974

SHA1
678d0e0b2002136c9238bc35198e924a7b4b0e57

SHA256
e8981beea26d9affb4135d794e420e7d7a48053f64a0b1ccc9b3c0f1b72a7ec8

SHA512
11a6a906656b0ae0062d97516de8f4904654016374c8f629248fcdb6547325895674a42427add0770790d8747a16f0c54cbdf08da21aeef1a7904edf393ec32b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
263B

MD5
8ff2dc3309ddc0f636a4475e3e3cc8c8

SHA1
b4177a5fedee4456133ed2164d8aee2809719cdc

SHA256
ca2378fc8c3a43f26329ac7c928a6dee9ee96baa3536b112a7e4f18709256fda

SHA512
c3b1c4f2fbf7f8bbc83a2f66fb490eca28ca79121b871c3a7d9061a5ae5d63e2610e96ebffe232820ce7f777ed299bd311a8baecb8f4f39afb5cb54940f4d1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6bd1468d2463975cb2ac1fcb260e98e3

SHA1
66df275d2012f71a191481ede745c40323ab6c23

SHA256
a0526502ba3e0189d867e81ba37916fd7967bfacb58dad9989645cf5a148d3bb

SHA512
db595e7aa497f6c29ae5b1c8d35404de21b7037594a071dd26d7c7608bdbe8bfaab350b5d35035ec60252d0d1c898eb808e3e6b31846ded06fa9813caf7bc661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a5832ca8d4fc0fcb31f7dd48523a514

SHA1
8b954a78cb4cb67c25e159ba34b1cf5eabe23998

SHA256
504e37f69096b5673421fd9f875d80da661ad90553f7f8a0554094d5be47949e

SHA512
c4ff5e0ab65990df20bfc2668277aa7e994d8474d5dd54aee53c3d10bd99e7d2f5cf0e95589757b3a17d6000fd8d3f08a71c401a3036d7cc1ae0a344814f27c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff2c0ac6433fde393695722939f913e2

SHA1
c4b8d464ca09fb250ecfbce223a218a9ac7487a5

SHA256
41bbe95b55e966c374645369343221417fc492840e0b513d611ab669d58ce4bb

SHA512
23c3fb51f751a81c3a16e9e48f63ea4ba99bf25bc3844db4f028a0044459bc5f6bc11aa2fdc082788c339eaa75824c841aa097d86b9bd6754d3c0d3a3a457a12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da429430241d61c7868da3af579bd406

SHA1
80275edffba17f334ca634fd6b57b6d0fac469a2

SHA256
95491e0b3b65bd61d588592613a4eba026c07e3ae3f74d72bfb829723de9fc49

SHA512
5b5847a859968f72f80aaa8800aedc12332cf654337da0bbba22cecbede62ddf2e94030eda44d777fde7b1b3b4377e515b71e1bb89e88379373879d3cb563969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
3a1482d971e7dd553f0443c290e6a461

SHA1
03feeafc68a31b8008d4d71db7cd4a7524b94062

SHA256
36bd9a12959ab6317cf9d859fe35d36cdec6ee0caf6484aa4122f9920a59fe9e

SHA512
e4557bb872d7b90bb1ef181133ad36f3186cee0bcbf4205e1d9485d86bc0bf25b944476ec9acf18d15e449a983ba647caba6abbf8fcf8affed5766b0f905e728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58027c.TMP

Filesize
203B

MD5
4ee6175c70b2fc81edfcb68c530a5e81

SHA1
c6591daefe03fa29c367de954e50aca9895185d8

SHA256
c902c8e867d98dfba3570c781d8730099e2a517ee747e5d098955c807957f084

SHA512
5b7017a0943b5afdd753a47d619299c815fd675e7aee7417d20908d087915699e1ee2d64f82b9890dc73f1bf8e4409aa347c630cad8dda3152c424f4d061c0fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3f101e103ea5f46d1e30657ae11b2f6e

SHA1
e287f046f5d49061cbb53ebce3c67bb05c7a5df0

SHA256
efe33f86284e85bb6442038e262d595ba1f1d247c1dfb0d4bf8b6dab5c766d2b

SHA512
e100063ee06b3ea816ea655ceac79647e493eb41cc5ff6bb5db2b1004a313f4dd537319f1f3ef8879ba9891f81d3416a0c27422edfe1408d5cfa4f8c3be96f8c

Download Submit