hxxps://ab-maschinen[.]powerappsportals[.]com/

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ab-maschinen.powerappsportals.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
3304	msedge.exe
3304	msedge.exe
752	identity_helper.exe
752	identity_helper.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1752	3304	msedge.exe	82
PID 3304 wrote to memory of 1752	3304	msedge.exe	82
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 216	3304	msedge.exe	83
PID 3304 wrote to memory of 4692	3304	msedge.exe	84
PID 3304 wrote to memory of 4692	3304	msedge.exe	84
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85
PID 3304 wrote to memory of 4624	3304	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ab-maschinen.powerappsportals.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff636c46f8,0x7fff636c4708,0x7fff636c4718
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18072606903644022505,8558385655361697595,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
8a2163877bb20d932b76a72029076d1d

SHA1
678c7754e45942da1a93845af890b1a7f30be3e1

SHA256
ada9e418739bb69af41397db554977f04fe28c6dae48b46f333e75fd8bc29813

SHA512
7362dcf42ef9e319d8b9d1dd3be9a771fb8598664e3b561d9f79fe65257851fcb3ac36eba9224a89de721d4472591f63d1c9e3eaae3bf2ccbc40dfad567c9c0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f5af398efe0fa9e135f59c51c2097726

SHA1
727d66657e0979625d3bca801f16e2109cd33592

SHA256
093b36fd75c72fee3dcee20288eeb8c55b8c3abc4a5958685df8144ed91c653b

SHA512
f256e9734368effada25b29a71adc450238b3b872d279f7dcc854508e3201d2411478c8fc28920139121f0d0ea0ff20a9110c404b40e0a438d517be36a44f653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
146bbcfb8e26af3d2481cc0d0fcbcaad

SHA1
a16f311a2cf26c653e3a53ce7534f2ee4467338e

SHA256
a86a2bfd7bedef7503c445d60604247d48fc3fc5361a6feaf3aecf9c7ca94b5d

SHA512
b905f0e909d4e3fe73d784b12bc4437f8e18cc9bbd3f58f48ba20a10d60001b63886d2f419bebdcd528e7bc1370fa6456368e26d9938b9a695478eef6a44a0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de497fe6d44c8531798c2fd878ba4d3e

SHA1
0d1f160e552650928d09d8ab467fe55bc5d122cb

SHA256
a2ee442976fbc2bb12ac09a03ca8d7adefc57fb2dbde70ee2d5089e530141962

SHA512
313a94a5b29b7d252c1830e5e8a24d548b0f61b97cbd33e92648e2ba6d454b0962d9c7997d8cc78719a652472536a260e66fdbb3dd64bd8792c3d07f4c7ee001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
acad349273ca4343b6152709625e72b5

SHA1
2903a4ca4b0d373859084ccf066efe74a6d5c43e

SHA256
5f0990a76186dbbb20be32275c386968479783778866a92af8de1deedca5be9a

SHA512
0355096d261736b63446e330ddbde7526b8c366162aa8c77165315a2d4ea081167ba021ca64b3315e9b14788e99359b757e7be6d4033d41bab48041cdad24bdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
306610d0e5fe5a196ea6b9d7f454dcfc

SHA1
63587f9fae073d5f66b1291fc632937c554b355b

SHA256
d730b5cc54a5cadfc32179abace8d71eafb856cb38c5f1a07a44a0eb03655d3c

SHA512
6d8aeceb5e572ecc467446806027c3af0b88d5b0f9db9b98e19652a2e60c97447cb6427fb1dc710591e73e99f0b694b35afa52d874febe4c19659ae83fbbf13b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57edfa.TMP

Filesize
538B

MD5
57c10b71199d69783abad88a9b73dfd1

SHA1
f3d94f40b51c05c09decb2c8b544d969d842b29f

SHA256
b937dda18d1ca4bb747a77c8abe2c2beed8bba88fe11473e83e3718943777b3c

SHA512
752d36c071b2eb8e1af6e75fd71971462e3a4319e97821c4d1f741d49fca426421aed9ea3878dc13187b4f66c0999793e50594321b290120b81efd94b73f23fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf8cb3e7e2b6fc35c7a45a2aeb979f3c

SHA1
1841fb54beef8a1bcc99e05f3d5bb2ecb26c4ef5

SHA256
3248c359c3f46af8d4c815a8d17367df9a18f7f3f928a7ab592e3f94c00d14e5

SHA512
d1f6ce39ef8f2478f29c23da7dd28cbabbac9d4f9e604994fcbdbc50a20355516ff7a1e818c2dc88bf5749904264c9bfba84720c6561a66e2d72c4a6f0e067b2

Download Submit