hxxps://theoggroup-my[.]sharepoint[.]com/[:]u[:]/g/personal/rohit_theoggroup_co/EW1S6u7eBPZAkl8sn76CFW4B9_fhjfgaN299JnYAgaQ9MQ?e=CXhREy

Resubmissions

28-11-2024 12:17

241128-pf5eyasqfr 3

27-11-2024 17:40

241127-v82seazkgq 5

27-11-2024 13:13

241127-qgh4rsvlc1 3

27-11-2024 01:47

241127-b7271azqgs 5

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://theoggroup-my.sharepoint.com/:u:/g/personal/rohit_theoggroup_co/EW1S6u7eBPZAkl8sn76CFW4B9_fhjfgaN299JnYAgaQ9MQ?e=CXhREy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2556	msedge.exe
2556	msedge.exe
3492	identity_helper.exe
3492	identity_helper.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2348	2556	msedge.exe	83
PID 2556 wrote to memory of 2348	2556	msedge.exe	83
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2360	2556	msedge.exe	84
PID 2556 wrote to memory of 2952	2556	msedge.exe	85
PID 2556 wrote to memory of 2952	2556	msedge.exe	85
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86
PID 2556 wrote to memory of 60	2556	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://theoggroup-my.sharepoint.com/:u:/g/personal/rohit_theoggroup_co/EW1S6u7eBPZAkl8sn76CFW4B9_fhjfgaN299JnYAgaQ9MQ?e=CXhREy
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa803c46f8,0x7ffa803c4708,0x7ffa803c4718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,15555401186724809596,5006622957723919696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
de84a9c850aee85151e3dd119d479505

SHA1
87a1be448e1af82f841919e46f7e391dae4db7f9

SHA256
ae8b7b5b3b4350761ec0fe798826ae4fb774342c4d739f96038e21f00daf6f88

SHA512
8360c24604dba635bb2571c6f9c7f5e16b8af06aede809f4a496b2360ce2bd08a0b9eb8ae4ac65a2ac9350a34797ef82476b4cee7aabecc6d839dd1f4c950f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ac22fc54b2599a33e6ad6afbd70b7797

SHA1
5d2ec9c50488bd45862a499b3ece759952a68141

SHA256
e05a63945174275af9fde6190b8b7eb39446d62ea419df48e082fd6bab7b6f6d

SHA512
24cd5b3658fe3e9f0a406e364cf69f47ace6c8e7204889ada6195a0ba3bcba71fe58e7f1a70a8e2dd40fbfffbccd59c6383f15af8e41f1eec8f182eb5720477e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32617f0bef4c5ad9529fa9a8be9c1500

SHA1
056babd55adc7b0427975c1b85f4bf4facbc68ff

SHA256
b3d3c78a30fa441deff11d63d3b9bf4ac1112039eea93a1bec4393858ae2f8ad

SHA512
e8d698d8b517fa7fe4d1c27f5f1d36b633e478111cebb11c8e89098b958dfd7f13a855d19441403940c80e1cf4fd55f649822f01c8b9a2d5172bad5d3a423076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f117e73304a673769f4567ed784c0fca

SHA1
9d72d6fe1404385ae4a6a9c107784ce136ceec57

SHA256
6ff23a5c861378e70fd2dd8e7a017c9af14bd694ed799d87beeee77798b460cb

SHA512
ca010216e8ad5b93c0e5cfb01c05f8c2118d746b317c42225d2d24aab7eb9f0a3d06f8535a23e1b07dd289b05af4d9e3d5983db5e0e2a168ce5560eeb862238c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
568a9d3b54bbc6b68eceb46126bd8b47

SHA1
0d1d03b6a7b3ff0c0e32a7af7de8d01ac9174ad3

SHA256
9f1d35b74c6716cc026f71ebddd08c724ccaba2f33b03e8b29bfddab173e05f9

SHA512
a7e493d1f84b6c783a31283e429bd226d3b38ba35eeafd25f8aadaeb7d730f0b0bd409b7d79a729fe31af30be2911f9db7d6948072abafc639f60f569c06e470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b4ed2dcb0cd51da41ebcfa07bbf1cbfd

SHA1
e37b2c878b357005b537c2d978ed140327dd96f6

SHA256
66e9d34e2942da9bcd18c9caef18d4f5708ec8815972b65f4e657c04a4fd24f2

SHA512
02285193451e683d0915ec7e8e74cc41ff84bab233e39b8455cda72c8ea8e491ac6cbf61d31502f436f0ea0ae0bd834408f7cda8d8300b71c232396cb24206e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
716375d668ec34b5082d513110a89120

SHA1
7f523d90b41830d0c64db2910eec991513a7c8e6

SHA256
07739a3ec3ee2fbe9743878bff1c0ef2df25bd965aaa48fd8532d5354dcb6cca

SHA512
6f1daae83bb4fb1fafff130a1c58a328d9fbc331e945c993cefc24f39a894ea0d99518f1de51fcd930e4d65feeea7dd44ad004b71fda82c841430df87dd4d69a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ea5561d14acbe26dbc94ba01cc0203b8

SHA1
3b233eb5ad139ddd0da77f1d27add13a965e10f9

SHA256
c585038ee6d3c3a76f0f29df94737931e7cf693ddc3458dd13f7b83b4dadbc07

SHA512
ccbfcecddba502ae5b3720eb532ea4f1d19345368450bd037165b6bfaf2d5ecc28a56dc6de695c2f4c9d750fa1555ad725cf244040ec8c9373e3ba77460950bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
139eb43788715a92aca76677793e8b15

SHA1
5a9edf610f1c049564057d9e62c7c329b193883f

SHA256
b1bdc4fa9b3128ecffcbdfde28a32fdf26b93454a333d18d3fa9c09b4c62d19a

SHA512
73d96fee728d9946f3714c3cdb3592ad88714a0d6508d7c172a18184c7af230e36b40cda2f895c5eed57cab1fc9f9a32fc815eebdc4e31fc2862e59cfd8e9d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e157b81ee9acbaebdbe637a457f84279

SHA1
0d7a78906d4e42f653eb7f37b1fb27dc44609281

SHA256
6fdbdb48f96cf3280948af4340bc35057fa370e37dfdbe8f0b16a261e8d5de07

SHA512
f4c605696a5d62ed3898c05b87cc51e25003dc7fa3b5db844a57742214cd89c8d39a9ac5fe339aa9d2a323e1c6c9db4d333ada8c8827b6e82b12f8063064008a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581d76.TMP

Filesize
2KB

MD5
98b54276ff7002d153a4d94e0178b18c

SHA1
ffad5c0a03eed1a79be61bf36110625d1233ca05

SHA256
b77825f77a350fd356aaf9652304e3d6b6a840b99baa1f12d261c3d44180e076

SHA512
58dba4a226efa44246d9bfdb2440cacaecd7501dc604a08e3785b6864c87d9bf66dde1ea2151445cebf5b89b75b339fd6a46c7bdf885d87ceef9b9ac505e89fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70ee5333403d1daadc3b174af9b8ec18

SHA1
073a7068dd48d6128e5fd1c0dfa5a95927407931

SHA256
7050149080971539607a7ea5312958d38c8976a8f2ce888963ff2ee2d7e93195

SHA512
2b7496d0a126aef27867b0f11b4260c462ec3ff3d2934651d55c26e7e73a716bedb5a19932d6b7e4e50d0ca399f38591f3755f7b08df9f02edc7c758d1d7be27

Download Submit