hxxps://url[.]uk[.]m[.]mimecastprotect[.]com/s/mHUiCmQ0WfRqE6PUGfxCR4LKj?domain=doc9987rr8[.]s3-website-us-east-1[.]amazonaws[.]com

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 04:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://url.uk.m.mimecastprotect.com/s/mHUiCmQ0WfRqE6PUGfxCR4LKj?domain=doc9987rr8.s3-website-us-east-1.amazonaws.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
2000	msedge.exe
2000	msedge.exe
4036	identity_helper.exe
4036	identity_helper.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 816	2000	msedge.exe	82
PID 2000 wrote to memory of 816	2000	msedge.exe	82
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 4920	2000	msedge.exe	83
PID 2000 wrote to memory of 3868	2000	msedge.exe	84
PID 2000 wrote to memory of 3868	2000	msedge.exe	84
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85
PID 2000 wrote to memory of 468	2000	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url.uk.m.mimecastprotect.com/s/mHUiCmQ0WfRqE6PUGfxCR4LKj?domain=doc9987rr8.s3-website-us-east-1.amazonaws.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8156b46f8,0x7ff8156b4708,0x7ff8156b4718
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17485786944825438226,14725263412519254569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0954f916-a0b1-4e47-9cb0-33fb181db081.tmp

Filesize
10KB

MD5
60ed8d59e4d9b33a1709b20ff20ac5f3

SHA1
86f8f18491b8f63c3bbe935a592c2beb4b7a5b6f

SHA256
86fee402a450e95fef277a2ab56a4fd307da8cbcafabedc92a8f04d760379949

SHA512
50107958914d6b6911b8fd6860f694235b6f56321b58fe0c8ac3071f95a490db1cc3bed7d7d2125cf5e0ca88d4c9c74d8e960e0d039e222066296d89062788dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
32c2944702d53994c4f99a1c5e0e003d

SHA1
59b76de03e60d620b6e1884065d4460e8e401d06

SHA256
202bff021172d81cf82b32ac8e50694189ba52c7895f00431623400fc3d4de2a

SHA512
dad0b7240348a566e8686a685c7789a2924962ec94e0d1af141ad5fef593108e58e4fcb2a65f3340a30fbeecc0b50a1a838ce72a958bb7cf72c45882d34a420d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eb85c305948f89c4950be6b88768344b

SHA1
9766fa789b64195e6cf4cf97032bdad53b3f8790

SHA256
037360201fb538ca095c97d5e6e13b441ef8a52264d2f87909201c7a2cfc84c4

SHA512
82b0994ca0206be6a238b159fa79bb3bf9a81dbce3861d8e2695e04e574168253b3eca37f3f2afe544e9b19a7de216b8c1733685cdb54712e11c29148869bd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
653d3d3fe6d0c6c5eea874367dc967f5

SHA1
348966463cd2a720210b765c8853a286152c9a56

SHA256
657c7ba097300838deab454d0905366968359ffd566e9501d5995ab46971ef1c

SHA512
842d27bcc3191e0dfa4d25eac566a69062eb69ed3bd7227aa636a6a635894543e2edf807b428518db2614f0244b082fd58e4fd5d8f9c152fb6a2aa6a91e8b1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2898707043a0ce5b06478e46e491b50e

SHA1
34ebb9560a50e6065a2693affc7bf21879575114

SHA256
2025b7b233c71fb1ad17b3f8efd81596b0caed611a06c984a8adbbfa7e9c0db5

SHA512
b57e3fd1f5816513c5474540a1ddd9eb26d3da89ba8099bd8c680f52a8de3a1d58e564bccd7181e44e456294cf20eb8458facb34226428c943f58023932f89ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68f6cc66b1aacf3d10022735feac4b0d

SHA1
3a4bb1b924ce36f5adf52ee1a2e0d9ac2e30825d

SHA256
642b427a1a470a5073d41d9d1d7e22a04b690ef87e1202ba8c054df4aca21775

SHA512
010e31e05145f6fb58ffc81d32ea16e1f00963758bdbf9016a4f6aad0db4156a8d6c69e6a5b97d3b91abe9b4b658359585fad6d3db68dd168354c965a62acde1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4522a3ef9d4d1e1eeb5149b02c1c015

SHA1
c3a39996d9d3e80d0afe8efebd9ac1cd5fe32ef0

SHA256
2779e834d2a76879b35e0da46d2bc6138edf6523bf867249da0cf60338cef26f

SHA512
8c5c77a7f77b03b080d6bbbd30d2202aac267c00a8e4c375e463823a1de2a5d83db1f209a88c87b978ee349eee5e34ec9ad133af65ab1889ab42402c3e086e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581fc8.TMP

Filesize
370B

MD5
fe7ec43af24d3521653ea817c764cc9a

SHA1
b849c39a20840a955e1df1b93d28e7ec12845fc5

SHA256
1d1643b49b894977fc9e1d28314da983c3a240a9b2bb68621e20e980f8697ef9

SHA512
6ff5c99c92e688bf03ab6c5615def2846bcacfadbe1d75a825725aef52010d3d78c93fbf280ba32f881d38f341d0b7db4de4de3b0b539d2b1cb0eedce6882ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit