hxxps://trk[.]mail[.]ru/c/zzm979

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://trk.mail.ru/c/zzm979

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
2168	msedge.exe
2168	msedge.exe
1108	identity_helper.exe
1108	identity_helper.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 556	2168	msedge.exe	85
PID 2168 wrote to memory of 556	2168	msedge.exe	85
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3900	2168	msedge.exe	86
PID 2168 wrote to memory of 3448	2168	msedge.exe	87
PID 2168 wrote to memory of 3448	2168	msedge.exe	87
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88
PID 2168 wrote to memory of 1504	2168	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://trk.mail.ru/c/zzm979
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabd2046f8,0x7ffabd204708,0x7ffabd204718
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17138617670603699716,16559065691114611215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1493a7671366be9f6f064bfb7af2956e

SHA1
dfe76da35bba6681a856e9e1dbe4f6f6a14f56c5

SHA256
a78848bfc1df3bc9ce97557e94d25e590286b5bc5e4de8fc68cb9f443e43032d

SHA512
4f75e6713b6bfe8aad6f0ac06e04778e4498221d9c98fb55f335e3df20b46476a78f6c6b9d4b228dacf86284c6f2d13d37f818253f0beaead2c676707ef30b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
899B

MD5
4637cf993c36a81174ff1dab4166ce6a

SHA1
8d998b5de1b7a2f1063e8df199c4c39082bcecc2

SHA256
80af1c04bbf7a268a6692e1d62b5c6e77ffebb0418d02c492b1d44756ed43cf8

SHA512
8bf7d4f5d1fd36c6587ef3655e51628c4dbd8a9ef90ba79f837e4e284709fe4cca483eda58289731ff2e1cbcad6eab64e0381470469071e9c4e13ade4d80fd47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
419790d5661b3608e1d638b6869d6089

SHA1
b50dac0fdb67e8ee4ba115642e1d79d5babddbb3

SHA256
07159b9b183d7381d0e00d1b296e0f5ed58f9431721dbb12b399d56ccbae9853

SHA512
cb3025d434648daa7f1417e9b30b5bc1cb603f0daf29b6136aa5999c794967dd076fe5f6f0bd28471efa9c5fdd3dc401c0a9f92440977a69a6b09daa1b097c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aaaba7a3b519902a8aaf3766889e4219

SHA1
630431ea1388f30bf6c87a8899b16ffbdf36bf69

SHA256
b50d77d3fe9867127cea0d67f1b1633f33d4dca6b25a087a8f2d8d69d45af847

SHA512
45adfb8aabc2c61b8d46955ba29db67699cf352047e1b95314de249528cb09fd66fb68a983ee33fda3d57d99d7a7eef0ccda665be3326de2613b57884e447202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
5cfe613315324a1fe9b5a434f18cf18e

SHA1
a67831d3ca3f3198830fe5e8736c4ec75a62196a

SHA256
f7c3770f238f0c1245ca32b1a058aed05e865141904a61232bdc51bc91483f9a

SHA512
090343abe7dff8261fb47115e58845c74003ddcdb5fc2491b69e6d1728671da684f52608c132f6e6823e0e0389375a5411f531cb06a1349d4e1dfdb19c0ac6c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
dc2cdbfa284dacaf313a9f78c1daae42

SHA1
d77287b5f12eb85ef9f6607da6fa2e38f90b2150

SHA256
ad41efe685e2e6c22a55a20a22d75ce1228dbe2ee0044e607243bd2ac03123d6

SHA512
e8619f392d3c0306d73798a77ee6dfb4cd745ff4a0c6f176c79d9e0079ddedc5c5ca9dbf2bd29bea6c2659006c38e5e13615ece6bf8db6360ad477e35985d6ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
6aaa6e30b0ceb22df822a7ecbccc149a

SHA1
cbcc55ad0f5abbd57bf276e8c5613e3b596df724

SHA256
632c9b000a833478bb7796f24da3c11024743868997f44b1a50b70e11a5110f0

SHA512
5044cd4f0471968461ab7ba44119c15c21bfc727cc859e9f2d4975650960a816892ff175dbf860579391f66d5bdc66f0222a07d3ca4d1769a99c1eb864c0afc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
899a9d176f2893e417cd6fda05a3e25f

SHA1
9102c9f55af9afa53628aea4aeb600b6f2742c1d

SHA256
36b7f54aa9855201912e347e29815abf96cec581b8e783101a7f03a3494289b3

SHA512
89ce06fa6d3f791e08ff4860dd3d0d4b6b399e3a209be0622cf85b515a783d28a438c468592fb848a070a87cf9db71e797ee95a02feabdcd2fc888465fe8e58e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
a9d9c55a6147069782bf8c72dc14b685

SHA1
7972cf46655b119a6376d335d286b48f889be2c2

SHA256
b4e406acdf3407ea148febebf769e80580ac61aa4b79d68062d88820f7cbcab1

SHA512
8782087c7fa0f81a60d8552f62574edf4bb7ebfab0f0721857fee9950d134f37181a88212f7f95e8e2b88fb4f77c7158b18b42e4f678d873ad8b6cc8ab603d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
9f205a42935adcf9460fe6bfba1a6468

SHA1
692a4745029ce33a23503be8e326d0609912d6d3

SHA256
059f88c271d3323bfba7e36a00fe62405b1ab0df8bf17907012beab03de4008a

SHA512
9eb6c3bb54489c2f351aee5bc710f34b2dfb56a9318a6776561493092442e0eb61bf12a23f1ac6e014cb61027bae98e647ad9f6d2e7f01bac33c11cc0d253189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
30b6a399dd1ed02f1b3dacd2749eb5eb

SHA1
1ef880d5e4cf520b7a6318ed5c36605ed75e830a

SHA256
f6e5c5b6d2d7b3041d06226d4c0cb69b79cba46359e477702b9cbc2be357dcb8

SHA512
fb65548738f0756757ca4a9a9edb498b7ad251e86353f5a98955acef44d5a9f7ca6a50bed8efda0cbe8ce226fde24f7ac55090f0476aa27d0d90768cdb630e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
b7ef5add78791c37be546cb7ee4e8f91

SHA1
f177336bd13159b9ae4a2c8b4e29687c5a2f1e1c

SHA256
c64bc4ee1c9b55dc1b000d25dd3526c562578ba35b42816cd5a62ae67879f741

SHA512
89749c0e4116834d34d95bf683c9085c214866937bf3218d679e0cd5a4f549f4de39c742cde545e6c9ad17edfc2d543037a4c369f5148c63aed93a401a9ebe26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
f5168a71ac70c411fe0b3fcecd676675

SHA1
282532ac8969b63e13aa52c84750a1365a9390ed

SHA256
1f1d15128b10c41a0d7d069400578066f673e3ed0c26ecabbd77008284cc39f6

SHA512
5e12e25eac8e99d2426d8d23c2a1bc77a403ce67ed3059aaa6a38a4ff17e2dd1f4b4561b4a1d64518eac436608c4ec191289b8b38bb351c6f0f00f01873ea34e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
991b57eb781f155cb4299d7dcd661186

SHA1
36e621b59c7e91c9e194e245c3efd469059d50d7

SHA256
7c73233f13469c0812590c4005599b3d4cd13db190e666c92215b3be2ccf0a26

SHA512
f4ae474b1699709f15fa023ece7daba65a368ef197a19f6e8a441a2530642744e8167b26accbcbcc2aef005cb29689d19ebfffec1f7a461d6cdad20ec8e75bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
880deae51117edf76ac18d641818dbfc

SHA1
97dd185f7be40897a45c8042e4718f3dfe1f8514

SHA256
4de7da850b401444049e24b898316d0ae93571505f26f958e6a41c92b21fcdec

SHA512
f0389470e9358e07045543d63abca054c82b2fe8cd0f68e30256fe8966fc799b499eaf484f02906f4b7c891e69025f95a9b62b372e0a4a0b06174fa847ef1fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
a50d4d2bacd0de26ef67dda57622f053

SHA1
0c627d7bc358aefefbbccc184097ea79a83da841

SHA256
263fae429e8a005d8f68a351d8cebcc8effded6434e7af95e5f1f2a4d02b336b

SHA512
99e19500dbc3abd57ec12a053bc7268cae8b92c45a4c6e988c0eaa746253421f1f886f99929e8820dec6c01685ba47467bcba2b254d6c77c6314360dbd6456dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
0e90dcb1fd03f4da24126ad25772275c

SHA1
54f05851831f98a05973b51639af3bb069748c3a

SHA256
f85c01a354d736bdb2eb7eae897c18ed28eefcd4a5086fa6c3795adcae2294cd

SHA512
3823c21fc518ba1aea46a17f41189423fbf8494ae6462a386fef5698094b9fa45101d91c5c152ff69b9a14d1b6eb8bbe3fa95d74be608c735b1013e346931073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
94738579be52224959650fe89e5a9d46

SHA1
64e40f31bd4657efca9896a416e14b78222687dc

SHA256
ff0dad2b57d001a4e81ffb99ea0b4a3b0bbf31895275b912c709ef49f9920e1c

SHA512
22658a16fe2518f88cc03f961d870e41b3668f4fd795211634535febfdd130079e42d665f3732a1ba2e618fa1f7fc496148e2de1d6f23628712ed7ec942a2224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e323c433ebcfae1bd24dfe6dadec1ade

SHA1
5aa3742c84ebb895d923aac294c63b5e97adf699

SHA256
f2c6b59523595fc6b30237d58a17747cf1fc129bf8241d8e3bff549923155bd4

SHA512
29438e211cd18d73bf7bf994e1510d8b5d7ffb04e95ff6f1f1e3f93b721eaff8723f74cb42829fffc8874bd3718d3413d4d0f9c682414896189ffc8fb44dda48

Download Submit