hxxps://cobracontrols[.]com/specifications

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cobracontrols.com/specifications

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
640	msedge.exe
640	msedge.exe
3012	identity_helper.exe
3012	identity_helper.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1588	640	msedge.exe	83
PID 640 wrote to memory of 1588	640	msedge.exe	83
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2324	640	msedge.exe	84
PID 640 wrote to memory of 2608	640	msedge.exe	85
PID 640 wrote to memory of 2608	640	msedge.exe	85
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86
PID 640 wrote to memory of 3404	640	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cobracontrols.com/specifications
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfcd946f8,0x7ffcfcd94708,0x7ffcfcd94718
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8173479102528746586,17180311048486691038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
17909589f3f6b3bbcd31dce11e77f193

SHA1
9afad6947e966e43d17b8d1c735bb2ce244951e8

SHA256
0a852248ce0edf10c1241cf0b79d5887e42eef9366a7340e95468d097c9a9ba8

SHA512
801e7871264fa66ec98e8e02bf17a4c5d7674f2f523c60ca52c8f8a4fa10c6fb3f0d3b5c44c91d447002fe842c9beeb4ff2a209a6c7b1a1225b2e0e72f9377c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
545B

MD5
11d0483ae893cb3a95bf5153e68c62e3

SHA1
91f280971c5e0aa9751201c445fa4c35e630e3d0

SHA256
305502f86c6e9dea450e7c676ca185685f8c3ea6e53fef9d74a9caafa48850bd

SHA512
efe7dfe1102ca897994bb7776d5fc1b1a1be68159cb8adec9fe7eb28e4511996f7c2164cf1ebfd686884235a37680b93d621b29f6abd9d9a33bf77df62970867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c06d096cf3a07414b587e6485bb37f62

SHA1
6fcbf0fb9981081a88a8eb263addf738ad62612b

SHA256
b5fad591e41995fe2b6c874433b53fdf7792c90f4344677cd2c476b18beba10e

SHA512
e990e39e7ea044d63290e98bd7bbc9882e91b074c07a54d6618654aeaa59e555bc7303750f9be7751edbac3a2a9840923763397128dbcb5b58026a71f83af829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
05538b7161a9616aa9c0d9be6e96f03f

SHA1
e64a7209654c3e759b1a06931de0d65afc35a42c

SHA256
24d5f3fbbf2c7935bab63d1d990ae3170b2ef1cd45d7ffe7dc7f3a2234d874c6

SHA512
aaf9778615b24a740d73b3dbb0393f42c90937fea129cd13d8dbef28b0276ad5505dd0d372c5ceecbce2cfcc316a3da59499d21582dea436359a452e64241d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\999c951ec6b95dfde9cfc75607beaf2d6c96080d\db716fae-758f-4604-8b50-6d0bb7dfd648\index-dir\the-real-index

Filesize
192B

MD5
a2a3dcbd5a65306b52a5174433b43305

SHA1
261e2f5ab406ece8d6d4faf1990d1cbc0c680498

SHA256
948106c2aade2ec3d5ef43fe5b4c012676c28856e3c342161adc0ebadc3677e1

SHA512
9cc17ad57031995c8f97a4d7b678711e2d49c2bf043955863689574e3c8dc52ecd0ed980ed6cba64a262ed2617a1e7f6340ef73cf75c9c59b2deaecd4870069c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\999c951ec6b95dfde9cfc75607beaf2d6c96080d\db716fae-758f-4604-8b50-6d0bb7dfd648\index-dir\the-real-index~RFe580d0b.TMP

Filesize
48B

MD5
bf24a486369bab322e35d1982d2d5f5e

SHA1
c96c71b12751fc24f378657cf35e66f7447bafc9

SHA256
26ff181403129d449296431366c35129b25206a596af735d298db4c670dc9814

SHA512
c8fdc4dcdd7e57812df57f0de6b8441860a61dba50975e7c50e6d0eed0599044590824fcb0e07026cc3536cb7005cfcedf6d09a94f5c0e270da04caff2ddb0e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\999c951ec6b95dfde9cfc75607beaf2d6c96080d\index.txt

Filesize
129B

MD5
c1e15055a17eb10d53823368a939b49d

SHA1
407011caecad03a220bedd1fb597087b1ad805bb

SHA256
51ed83ccc85c05561ab59e49aa0150f2ec4087d725df460efcf7c1d50cd5752c

SHA512
589dfd1c0929aabadb0bc7f63ee2c5c9b5f8295fafb674e9ec8d2c799fdd6b36662062d145af227536af1d31397645f4c7b45251c99b1c56b8632d735a2441e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\999c951ec6b95dfde9cfc75607beaf2d6c96080d\index.txt

Filesize
124B

MD5
3cc7091ad1e2d9d48f0fd2ba0fbc32a9

SHA1
d71339cd4219fcbc258c88197b58edb0d476f6a9

SHA256
819d479f1358c804f3e2c76c0950a2eb901a9fd9c531f1d86bbb9ea16cb60676

SHA512
06f1b9f72f52f18cc15e26363da81fc8cb02a5db778420eb4af636172872dbf4adb321d3f7c512fb9197405b6ad83478f4f3b1f1ac5cc059a28470ea65f7e63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ea5acf3014c8f8612e2a84c013b38701

SHA1
6da28ac1cb7651df329c6c34b1181ee054b98871

SHA256
99ff0b62fbe8ee4f3c1d7f4761e1f1647705bcc889155bad8ba772b987f38562

SHA512
865f7dec4fb0f8fbddc9b8a4a17c665b588be40a6c84ccee89c5c74fa6e261fbff26ccfd07f7c7db9d755d9eae9ad119d7e7e77239030ad155014517a762fe95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580952.TMP

Filesize
48B

MD5
2b2f962157013cbfed0c38c9ad7ee476

SHA1
3b8e946cc9a19a18dcf077af0771a974daab085b

SHA256
28ef43ff2bdfe007276dfe94d94f3d4bbde38f9b5b81a95ff5698222127d144f

SHA512
d3dcd42b101babf2a6d28ec83f828d8d80472eb97fa747fc9cfbc32fb1b6c37cd5968c9667c4d54d98d19bfb8db7233818bd7b603cda4e9295015affa23b95e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
700B

MD5
1a2cb5f17ca47053e64c1cfb91419695

SHA1
a649f165cb8d28121e0343fa5847109023070aba

SHA256
ac5ea9d749bc3714500ebfb1b290501d6f3f1939296de7738cfd2cedba1e3a74

SHA512
ea56f006bad9b4be60061cdbfeb6a762c8872664e9da1a1310306accd39ab1ea154ab86754c6af1b282871771e493965029ca52f59b3a0eb3a4246317fc527f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580f0e.TMP

Filesize
704B

MD5
e8c57d2ac05b12343a6211f00d84c948

SHA1
d65320f9705b6d9655e55d5dd372edc08a85796a

SHA256
dc0e7a3f49770abfc09a11be31f9c9e53221e85bce1167aa4890ed347db47870

SHA512
605c13cb25ca934ede0aa543e39358ecc564bd1cde31d8a97120fbbc6a5bcad59a5cd5d2241f876f8ed87ba4091e902ff9bb5bff64ca3e35dc23c3f0c6fe2819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
970a8e68700ad16750dd55416eff45fb

SHA1
6bbdda5defcbf46c96a57ec132b0527934da26f2

SHA256
bf541c47018ca43c1003e60ce1feda5f3ee5add38f22b7fdd8b8b0d1a9ccae59

SHA512
2f124881240d648e29e6af7c7f6523c3b61d7618626ad58f8309b15a917cafd67825a111a2affd89710bfbdb6f886c287d96861a7be16671bc1f77536825c5de

Download Submit