hxxps://mail[.]google[.]com/mail/u/0?ui=2&ik=acb34b308a&attid=0[.]1&permmsgid=msg-f[:]1811989058793170946&th=19257a72da42e802&view=fimg&fur=ip&sz=s0-l75-ft&attbid=ANGjdJ_AAQWhie1MIdowMh398L-kghDWMNm_KL8c768oK5RRYSIvMiCNUQjq6kBdQFIwjXO4pbkHZoOsnrM8KNzhVv4yIMz_rdxNR2Aq2nzzNCjdQbniERHIE-Uoj5I&disp=emb&realattid=ii_19257a6bdd14cff311

Analysis

max time kernel
1158s
max time network
1159s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04/10/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mail.google.com/mail/u/0?ui=2&ik=acb34b308a&attid=0.1&permmsgid=msg-f:1811989058793170946&th=19257a72da42e802&view=fimg&fur=ip&sz=s0-l75-ft&attbid=ANGjdJ_AAQWhie1MIdowMh398L-kghDWMNm_KL8c768oK5RRYSIvMiCNUQjq6kBdQFIwjXO4pbkHZoOsnrM8KNzhVv4yIMz_rdxNR2Aq2nzzNCjdQbniERHIE-Uoj5I&disp=emb&realattid=ii_19257a6bdd14cff311

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
468	msedge.exe
468	msedge.exe
2220	identity_helper.exe
2220	identity_helper.exe
1004	msedge.exe
1004	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2180	468	msedge.exe	78
PID 468 wrote to memory of 2180	468	msedge.exe	78
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 2016	468	msedge.exe	79
PID 468 wrote to memory of 4120	468	msedge.exe	80
PID 468 wrote to memory of 4120	468	msedge.exe	80
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81
PID 468 wrote to memory of 4608	468	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mail.google.com/mail/u/0?ui=2&ik=acb34b308a&attid=0.1&permmsgid=msg-f:1811989058793170946&th=19257a72da42e802&view=fimg&fur=ip&sz=s0-l75-ft&attbid=ANGjdJ_AAQWhie1MIdowMh398L-kghDWMNm_KL8c768oK5RRYSIvMiCNUQjq6kBdQFIwjXO4pbkHZoOsnrM8KNzhVv4yIMz_rdxNR2Aq2nzzNCjdQbniERHIE-Uoj5I&disp=emb&realattid=ii_19257a6bdd14cff311
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x48,0x10c,0x7ffe565b3cb8,0x7ffe565b3cc8,0x7ffe565b3cd8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13869051045091753855,3566659814244293007,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
a7547bd1e4499c3c434d72850448e33a

SHA1
3962b665c25ae95417efacc8c90052fd1387e902

SHA256
d2b8c52ffd3e6f0701c6a39f5242574c9f6830c0e6fb81c5f88daebf6661851b

SHA512
b492207baae19204b33f7d28e917931e9f351e7580f12a3cbc1d14c03977b2a9b7c6f684c9a77c13a6cacb037bce9a3f4d3dcdfa5459df7201e90c66b7d0a95a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b63aa5eacd03b7df2763f6980ba25f06

SHA1
32bdaa49d9a3cbb3cc341c40318ca31ce5d2dcfb

SHA256
e7c83dde392aee3164bfff2fd5c95361fdc8b56f618aa5f45adbf86b7d9b5c39

SHA512
0a3b02dccda68846ecc0ea67d629ffbb61a749e4fa191a6f165238df73d2d3e4f6e22e473b00e754fc59a699c1dead9785839cf83372f22e0f55acbc585b1f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
322eb3a1225d929309e398cfd12c2d7d

SHA1
3be7ec442ca2fadb092bb1366e18648316a99f00

SHA256
7d3fea255e6d84e8553227d661afb6369c9084cbc5a5013cd3f3473cf5033fef

SHA512
fe7260e4b5de24c46de1b5c298aaf29e18dc7910ca4ebab50d6468ceac7bbef29826b144e2480c72d81e113452383a4d11b052741e5774470b78a9dcf7aaddf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
17095b6c36644787f4b5ca46fffc7511

SHA1
9dac3183d3c7bea7204838fcb6ac113b23b4bf86

SHA256
35f002dc1f893b26d2373fb93bd2dc3cee60b322d5390a4b5b87e685175a6669

SHA512
90a45bf9437c54051c3becea3e5334feeeb02add2366ba1c314e8dbe235879c4a1482746db801c46fed1665020ac85f9f3c6c69fb5095c85e96efcc279825200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5cb38a4af16a8c85c4950723d2d255c8

SHA1
39101e9c54117d7213d0f57579eb9a16d5f8e0f3

SHA256
efaa212c5feb7cb9350044b7190ab0026ca7fd1572d01962dbf7a4142867922f

SHA512
dfbe12ed863920b97b7559d8375afff0348b54da1049aa628e7792d2cfefacc294601c07eeaeb9f2acb570313ce559f35f735091f7df8b30edfe62efc9b4a685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e71d7a9994eb6bd6e544b5ce55a180bc

SHA1
7f20879f271f7cd6ec0ff71dcb34e025fbd25b2e

SHA256
d69ec1d75ecd34c4aa55938288c0ea3d352b9a826a37c87fbec44adb60699d70

SHA512
0f4331f908c1656c3535a3efa9205a0c24cffb11798ddb249d7e1179c51d31a7f0da5df9553bbd580f3937599b960562e33fea111178417f00a29622b1c9ed60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c51d748d206e956a3d2018ea2a44509

SHA1
0b1266dc77e78a067341b2668f1a3fee68b046dd

SHA256
882d5b6cd5947ba9f97658a7949b3ce9aa70c0fb1820306cce74c13fca0eca8c

SHA512
ef3155a8617a01638597e25335530f97ba82534c23188d5ad972232f205467fcb1797a0c0efde5c2e420a610cde3607046c1c1cfff0a59b6d2ada3efca3d4607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56dd04067dab405d0f8e26a12d6f4df8

SHA1
bc6eefad57c99722d910a4175a1d04f47e4a6336

SHA256
6f3558a92fa37c50878c3dae96d5ab28da9793721ae93a48df28a178ad43a347

SHA512
4d4e1d9e724ad06e6efa371ce5c1b7f475075b821fe43d735e38474b9bfd8978f6e50840a4b8e007f6b32a4fb3a369d822921826c562f21582adeb2ad08e8353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
15e6824bbae556de764ae4356e61e06d

SHA1
4fb4683191eb52a475fcd160a993d818b743854c

SHA256
cb37105d4faf47a8a9204c7ec7b5928a9b1398db907a38763ab0384209940194

SHA512
f93e6c2f9e9ceb7489aed9193fb1920bb5483bb9e9561af692360ac386980108b10b3f2493cde4c11c1bfde067629c95b9787871bbb01e8ea17466e60f441cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
34a23a40656175b97fdd0fe6c2f14b11

SHA1
c224fdad9b5418738aaa3ea74feb4ee617c934c1

SHA256
0a7e0905f419bca41374e13b7ebac8a944a4add724e9d9c80119f7dfb8b0e724

SHA512
49489f16ab4664cee41b8f3a928528945ee4227d72476cb83629610dcc8037e977d0f73b2cadcc7db95a45c36ab3f5bb6945b5ce61034da65de02b61f8f6cee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
58deada88a4b785ecc1655fcf06fcd08

SHA1
0d8d648077ee2488b95eb7fe8044b5ffd00d0c85

SHA256
10db38f2452dce23d6969265444648b4683381f62f273cb2f7730270945a03b8

SHA512
4db686450647ce6037701ad6a73cdd907d7536ef85aeeb60226d5c0099d33d50f86bc0c3a93c3c701f4607d1d11019c4d43ed2d9ef589aadf4a2c8a83c558cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
9e04deb7914aa94758eae1da2dfeaf94

SHA1
7517d4d5eb8f3d13ada805ef15411f1b2b61ed83

SHA256
5d8c3b7b4491d48951cf86589d590b8fb3d96c5b8edf863c6127b513ae67dfdc

SHA512
ce72c8ae96da137715220248ddc22c221b5939906a22032a6076da9c45aabe939b1fcc28541d3159a15bc97f846012762a76aae50ad41210827d5968b0405145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ad04.TMP

Filesize
203B

MD5
9a5f50e5574420887ea872e77c9cec56

SHA1
9dd883776f69d86efd36483fdf37a88dd69e0e93

SHA256
a7bd5cf07cc5550e86753c549e08f1e620e3e842ea8cac5fa9d751bbdf9401f9

SHA512
7ecdd6054974c2fb40ffe29772a302276fa18660b0575aab8a52c30c2edca49fc0422780c5131f461b7ac76e420fc845f55cf2d38ed2032de0de3b7946a00f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
78a63934683e3e4fd626ebce43db1f3a

SHA1
98f5787d2eea8ebb6e53bd98d2009f47ddccd662

SHA256
cd9e64db11985fed19adfc11b56529075ecd10ad22c511a2d2e9b6527cdc9db4

SHA512
ea576b59e1be5d250bb03c5d38701f55d014fe21e8d02cc6217275391bd9f759c06e3055bd77ec910c2ed3dbe5a9afdf95c663f1792731a7b2a4f117e80ea5b7

Download Submit