bf45f4bb83f70f8bc641f39b56be47f5bf7b3b9f2609dedcb7ad1004aa5d84b1

Analysis

max time kernel
40s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
Size

168KB
MD5

8df48db76679f51e832e0b48a89c509d
SHA1

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125
SHA256

771fb65b9e55db17bca18ea3594e8e8b4d5ef060919844c0641a02d9c3326b1e
SHA512

0e387586091b5455feb19fdfd45cea73f425cf1b8cc8fdc11e68d78826e30f3d148731713c796c0106aee1e756c514fa8ecade656261edc517333245170596c8
SSDEEP

3072:ELUbqjhjDUyx4HCIRoL57WpTlbYsb+L5QgDgZFHdrLTc5wEKctIZ:h4jJ4ORWpTlbYsb+L5QgDgZFHdrLTcml

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
2728	msedge.exe
2728	msedge.exe
4264	identity_helper.exe
4264	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2728	4608	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	93
PID 4608 wrote to memory of 2728	4608	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	93
PID 2728 wrote to memory of 2224	2728	msedge.exe	94
PID 2728 wrote to memory of 2224	2728	msedge.exe	94
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 4680	2728	msedge.exe	96
PID 2728 wrote to memory of 3852	2728	msedge.exe	97
PID 2728 wrote to memory of 3852	2728	msedge.exe	97
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98
PID 2728 wrote to memory of 3096	2728	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
"C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81fbc46f8,0x7ff81fbc4708,0x7ff81fbc4718
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8954376848927216150,316438025223089424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81fbc46f8,0x7ff81fbc4708,0x7ff81fbc4718
    3⤵
    PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
09dda6a6a209863c5c4b44ea8404b4a4

SHA1
367bfce0048b157f44ff76d2c96c5fd7bb51be77

SHA256
7b3976b32414905031ce4c9a43a8caf17af15624dbfd9bd13e6b9fe5ef4737c8

SHA512
f71e68ea69c50d005eb5bd3d79da7d8fa7cbe5ccec9091ad37ac3f46c602af532477f2b8781fd383a0e143ab859ef4b87dc4c3b8461c52cd34802f1cf1d5b151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd2c4f29d62a1c14dd16c6c89b7abf13

SHA1
9c0d721617d046813d0497966dd7bca80b7e1f38

SHA256
8eabfa02d35212f7404e4378f53ad7b684ea78fcb914a309f09df7cfc4d56c91

SHA512
7e55d1b4d05c68f050d5a302c2a35f0330bfaee40e40a9dd0d548d7c07f86f660b9fc90669e253045bdfa91b614eea4023d5c0b50effd0d66d2b49008bef81b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05a7f60097c90ed4d047dc3763ed94ef

SHA1
d7124473d9164d40909f5d9ee929df42ef902e1f

SHA256
772051ccf66e8ce3d30cceb62f6124a07011d712191e12b9bba03155718c3afd

SHA512
3ef0310c1554c554499114efd25ba001a2b7a570e0e3876d0d167dea69f1c35f2c2e9f0a295c236d5eb91a899a7586ed6ff0b359dbbe0984744bbbd836cc3f24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7fe97a9d93f4473ff1688f5b26aa02df

SHA1
442769bc2264aaf251395c43dfa8aae912bccb5f

SHA256
275fc5df323efa1828ffed4185d5c6b6018c578e6fc0048d1812e8bb1f7077a3

SHA512
cbf34db0b45e3ddeadcac3a295aac59494484182eb358a387caa398c4b7c2cbea88aff85b1d4e7dc8db968aee35b74c6a3067fc4179360d7f0dfd41c2b3df70e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9e72d8af8aae7df65e101824fb18e0d0

SHA1
138b0d974ecccc43b72bbba23a0cc309934f29a2

SHA256
190bd303e08e825b2c583361cac0c10bf96578d0dd085809daa4221579072122

SHA512
a4dbbd959a55f01e5e64c983d4af8006da686fb4aa1e9c9755939bd5355f2aaa6ca10dbc12dd60f4ae8562a2090f5a7d9239e7284a0ea62de9b6ce92fee5b28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee19.TMP

Filesize
371B

MD5
320eec450a3e753c8b03033f595482fe

SHA1
ed33b6faacf9c798d581460a5cfd10af085bb6e8

SHA256
58b6b715753c09fb263ec80b0100efafcf754dbb72a123dd415dac0c3805ce35

SHA512
be65ac48b0d11755549d10670c1203ce56c9886fdf7cb1eceff129877f89890ba1909c71122a62e9ec929bcf9e83c981b445c992b82096f8ed5dadd4dccdb96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fb828ee51cb2f82e7a2982dfd9554ce1

SHA1
1fb2667b3561955fdb9f643ef4579cce243c9aaa

SHA256
20111f0522b5bad00bce4c26ed0931852d5cdea64e61dc9100af9cc0d4ab4db7

SHA512
dcf186b0fe765d1cccaa0efddfce8d3460dddf884eeaf00ada0b8323dce688e6e57d6df981e2c280febe48fc3063b79309273ef0fb891f2b62fbff20d4a4b21a

Download Submit