hxxps://www[.]jotform[.]com/sign/250125333224039/invite/01jhga38be40d108fac1660ffe

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2025, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.jotform.com/sign/250125333224039/invite/01jhga38be40d108fac1660ffe

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Detected phishing page
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
2644	msedge.exe
2644	msedge.exe
1648	identity_helper.exe
1648	identity_helper.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4032	2644	msedge.exe	83
PID 2644 wrote to memory of 4032	2644	msedge.exe	83
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3600	2644	msedge.exe	84
PID 2644 wrote to memory of 3580	2644	msedge.exe	85
PID 2644 wrote to memory of 3580	2644	msedge.exe	85
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86
PID 2644 wrote to memory of 4188	2644	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.jotform.com/sign/250125333224039/invite/01jhga38be40d108fac1660ffe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb42b946f8,0x7ffb42b94708,0x7ffb42b94718
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9815995914119293928,7888309030092210651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
eaeea1ed7b26da21d5f1a4792f0171f5

SHA1
2d46ff145285e5438f194edbf9fef3238744205e

SHA256
6e96d7a0e49d0605b085d35e2a80f094c74f2caff5d8a84ea10be9a3db10a3f9

SHA512
c4d6b6ced1fd18146573d6d456d385394fdb627896147896d1ce8e4aa534f3d0b1fbe28fdffd6e7251e429083c65790ab43a966cc724da735cb2aff62949ddba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
a50df0b7c11b140ec426dd4436835b0c

SHA1
14b6fd196596d1aa7a0989a3970b2d279222c59a

SHA256
ff5e926fd5300cbb446d89a9a7dd0bd66b1b24c80266f6363cef52cdd01bb8d1

SHA512
9220d1c3203a682210506468cbadb7870a9ae4a9a5a7edbb9ff7920f0719cc549d49ddb92d9211c7e5917179df1c4bf0278880e7a32c9c14990e42d34cea7380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
833a4050b1530a63f5c2383af2b37b78

SHA1
9c8d4e7afb6271caaa446a1d3ed8ba4550464e12

SHA256
06b3517c17387bc5553c21550571bcd87929d8066d7c30a9921c8db02644e668

SHA512
9e475210fd0b9e97942c8cc39513ce3559ff85b94c3eedfcc9d996fad0899afe0ab469b9c539378efae5354cec7cbd555c82d2fedfb918d3c04d9f353f19a9c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0d4bf2ac341a6d358bb03b49b14e9a6a

SHA1
df4a93146b2280f9aefac3b68c71a4543d70484f

SHA256
f33be6bda1e72d4611f3a7dcdaa7de4cc7811ecd95bbc2e8b6b5ace9cd8eea72

SHA512
bbaa3108bc5d7874066a382488ee296ba6ac55405ddef5ec7c6e56b3e6cc9d2645f515b3096ee75289c1e6ce358f38816f931589be712e54a0a0d35197f1d3dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db6533e4cc16da56bdb72a4d06103c82

SHA1
a0522c95885009a871b17b4d0b13a688481564cf

SHA256
bdad242b38ce5cde05e3ac7577bd87e6c542e8f5af4bc590ca343ea8a8a0fcd4

SHA512
bbe3911f652dff3bf602288193d04fc12590c6132ad172cb57ee61326de598789507ea7d76e3550fd1d675fc7a4fe52a862f7ad043e282b7e4a853e9064beb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74194a896c1ccd5532230f8913769b93

SHA1
8b3891309c588b7abdad791eb0b57ab2edf07757

SHA256
9e767449fe3aa5c29903e402902f1f218f24ff26c4e09e84ae276af2227a7363

SHA512
7fbd0e196032429a8aeafac6f04bca38345b7309aecd763399b60e8ee81a9ea49ccf308affbaf8bb9623d29b5b2901a9fcd7b7258ccfb4ee7b90ac71fcb0910b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
593fd3ce2314fa8c7a850abd1776b13c

SHA1
dca501ff8ec40be721ec6c4e7bb18061c5b8cc38

SHA256
1ecc9d8b50a5d11b8c700d3e5a3cbce190af63f70072398414cf41713ea85b96

SHA512
3d853e3050210bf1289d5989265a27a16022a8bbc90d5eeb68eddbcba761af147ad2c623bc89358f1ce7e6949cfca36dd1c8785428b1eeb94f007f353be6c15a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c286cb838a9b4a0fc12150a1babc541f

SHA1
5e0eaca03e48e1787bd034975d3bdde54cc79364

SHA256
7b732ce9448dd20bd788f1b09f6fbce8d8ddd9b1791dd081d68dccf2e4cfb1f3

SHA512
7a7612521ed4d0029eed2baef3768107ddc291e73fb98e65d3b8d4594eb6881cc6842ccc8768db96b5312262a78b3176363a9349f5a7034932e115d297eab28e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
19a1d28c29f3d5c274d48682aef74dc2

SHA1
b3812b622ec79923b338625bbfda3c13fb455a36

SHA256
1ebeb7f511cea736ab4da734c2dbbb02e0bf896d031b8c5fffd333498026f774

SHA512
9668763ae270eae2881ec75c99ca2f79d324e3003e24af95359b0f51ae8d6d1a4971884a6bdd3495c5bff6b9f32a57c377a1bcd34e055079835fedeaaa018a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582815.TMP

Filesize
875B

MD5
d2607353c42e67d9d99288fd8c96c4fb

SHA1
378ad78cd538c828055fee7ecd371ea8b98f0d78

SHA256
c5caccb9093590321109be3362f374335b44521a856528d76f43f1ce8f0fc1f0

SHA512
823bc5cc7b1221449364a5112c86f0539121bd3e45a6e43e4ced727b88963bc6b8b7f56f70a1a497c11c84f4a504f888e3eb6477d7c398be99fbf3c2eac8955e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e656c1b1836853c3a56d2b87fa79c7cd

SHA1
9a60dc81fa18ea44aa173d3990f728a7a136eddd

SHA256
ef018285a1724821eef73e03b4d9b99609953a9459fbb4a2ebcbddb51ae1e689

SHA512
08c699ccfc10db0f8561154add79353e6a248cad2816e6617f9b3290c53d3c3188dd6a8f373f255f8fb067551efa663e853deefc307970aaea30cbcd909e60fb

Download Submit