04d95a3db480b77a0c97dfdc33621ae39fc7acfa4905f3b4b998d08219187489

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a43d186ee483a757a3439f3f642baf22.html
Size

341KB
MD5

a43d186ee483a757a3439f3f642baf22
SHA1

7fbe2f5b6e7aad2e32bc2d8d1fee6ddef29de054
SHA256

04d95a3db480b77a0c97dfdc33621ae39fc7acfa4905f3b4b998d08219187489
SHA512

f26835bd2f689966f26ee9da99ae30437010cb9b316e813fad23d251a89837904668800d9f6c3976b9af343bbb16a3fe20778094896f6408717a1d9aac1242eb
SSDEEP

6144:nKH1zwa4WXstOyhmv5FgrBfPGSudalMNVBaDfgaDiqZdHc5Q1Zg7h/WrcbvQsVB2:+1qmv5FNqZdHc59lWt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
4964	msedge.exe
4964	msedge.exe
4204	identity_helper.exe
4204	identity_helper.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3088	4964	msedge.exe	55
PID 4964 wrote to memory of 3088	4964	msedge.exe	55
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 2472	4964	msedge.exe	87
PID 4964 wrote to memory of 832	4964	msedge.exe	88
PID 4964 wrote to memory of 832	4964	msedge.exe	88
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89
PID 4964 wrote to memory of 3868	4964	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a43d186ee483a757a3439f3f642baf22.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf0a346f8,0x7ffcf0a34708,0x7ffcf0a34718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1122414868437640220,8508162997327220531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d62cefeb0c8fbab806b3b96c7b215c16

SHA1
dc36684019f7ac8a632f5401cc3bedd482526ed7

SHA256
752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01

SHA512
9fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ee1c6757da82ca0a9ae699227f619bc

SHA1
72dcf8262c6400dcbb5228afcb36795ae1b8001f

SHA256
62320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31

SHA512
dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
4941bbb9f872e1c817071b4627e9daae

SHA1
ef976e4830dd1f27eadd57f2aafb779540c7e1ae

SHA256
93485f5232a9e6d25783a65ce49b1a28705433690439302448f815719997ffa8

SHA512
bc3f335bd9facf09cab323f80a0d5013838a91db56399c3ac3f0120d3d34c2b1aacbce11edd6586395fb9d401e2ae7b3ba227efc9413e5155502bd53ffddef09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
858cd61a122964a917f2b52d4527e451

SHA1
c1cd3325d3312720b4aadaa19b43fd8c7a484a07

SHA256
dd904136b5c2dd7c0fd72fa057f7b8be24e75cf6e60844965e1ef2973872bb79

SHA512
445cf62030cccca9ae02c76586fc34cb7fc45f970b12d4ad0f82bb53192caa6593af5f13a9e516df994d3a0a61b9100adca166869b49698f8b230dfefa88a142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5d5fcec9fcff32c931a7bd06447847b2

SHA1
066d6c7c0cb99beaa18c24b76bbfbf44d5c6858d

SHA256
191f4eba5c420957df5350a17f7b34422769d6a63ce07c9d9fe7e8bc6810c737

SHA512
8fb03e4e315956d6f09c59d6619b64eb7f7fd9822704ffc45d437265a601138b491a4e31dda27715dc837f6abe3514eb1ae0187bc34ae36b816d98b00abe6746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1656b82fe351ec7f07da51c52700464

SHA1
e18f4c60ea8f5bcf7365d8139ebc9d7dfd9bfb7c

SHA256
e12d143e1755cbceaab6084a07e2ea47d7ba2c986eb361e79d17faf0679651a2

SHA512
68d6a84addfeb9d9c4d90d8ff9b33515f404826bd8290b9af29666c2e11a0b9ee94dfc7cfced11ca1c781f25646311d78d897e64e42d487b6a9ed827787c7222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98ca8c787535391fdf72a20bd4351474

SHA1
78a2bba03610165ba7e36eaf3a82106f7106efd2

SHA256
bb97fc5ac5252d8c46698952d556561c0ba836e8b9f0fcafbaf4289a78ca61fb

SHA512
92e67c5965f7f6579c2551d457ca1ff120ac946fbc5dd4d1dff73ff963dbc2ffd2850fbea2f41592afa98d78c31b89f016178511297559ef082b4657bc2054a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
de370edb1af21259f94ef1d25e785557

SHA1
818ec9a34633048c8960c2c9451c695b64f837a3

SHA256
c0cf65af4fda2f94eb09c331a182c7a1b1599fb2bc119039e46f697a4f4dcd77

SHA512
cc78a88bf7d473d28119185660af3c4905550f31fb829e52fd71b84fff00b71ef6cd3ee0dd50ff9f897e0973019703e483408cf41133d6005244ae724f047861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8d51430d60ce5436537f72d60eba3ab3

SHA1
d21ad7a034b7a2a2ee2cad571d60da15d1374dcc

SHA256
4d4a848d5c8e707ae01fc9b85b4cc04ca11f7863476fa15d166287cde669e944

SHA512
40dbf2b38db89c8064d93e9bad8ce4e31da6bc4044886fc8ecec34ab6728cda82d48998252dd775f07b4bfc6fd5f36a1f9cd43b0de26d0ad522f681670d33853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581008.TMP

Filesize
872B

MD5
d74275891d94085fd665b5c27be6630c

SHA1
45781dfe1cfbad140f0397b7759b4b24a461b750

SHA256
f46d578069bf1d38d2578901d7ceb50c8f8c3f3bf42f339efdd183de8c72a26e

SHA512
2c1cc1d18cb3d715753c93f16c9c0efdc4a1568aadf2f72c6f7a799d11260737ad57782602cad8acee9aa6e4047c7573ef1d55c98c3378e81a5a7c9281bdc7bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c57e5951ba5ac7a6d033fef8b558cf3d

SHA1
360ea3e61d2719d979be01851cc531c578f94050

SHA256
81a7e4d06a0e622e9aa7e2cb52faf9fceff3738c0513546a3d589b7f423dec7c

SHA512
8877dcaf6e26013239a069566a8044b8794851f5ad81a2f2fb41614adcb8fcdeee0ae0d5cf32ad2cb3f1679c51402ea8f4d280e6a3269993ee88c2fbfde87ef0

Download Submit