f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d

Analysis

max time kernel
1682s
max time network
1690s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.htm
Size

1KB
MD5

752a1a8e638938f8e466e838b330f7b1
SHA1

5a66c6f7dc710496af18360253677a62a5bc260b
SHA256

f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d
SHA512

e6f1333f3303b5c30e59e13baba529279fadb5a83b3984f0f83bffd69978146e062ab82a01e04fd7af2bed8a85aa6512acaebf24604c02a317ed8b633d736c43

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
392	msedge.exe
392	msedge.exe
2248	identity_helper.exe
2248	identity_helper.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 556	392	msedge.exe	87
PID 392 wrote to memory of 556	392	msedge.exe	87
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4524	392	msedge.exe	88
PID 392 wrote to memory of 4880	392	msedge.exe	89
PID 392 wrote to memory of 4880	392	msedge.exe	89
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90
PID 392 wrote to memory of 2004	392	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbd9146f8,0x7ffbbd914708,0x7ffbbd914718
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15112490238133685375,6765359723134080353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d6bbebe-f9ec-48a1-9fc6-38aad8e29ef2.tmp

Filesize
538B

MD5
f3dd94398ff3e8ad14f31ddbc688507e

SHA1
c713cdc3646fb1c60fcac989f00c69c335aa54d3

SHA256
1302e746985e0888107ea094e80c0ef26fb85a54de4a4090ae15f18534d0f3c4

SHA512
5d8de84929c6e7b6c24fd5823b2dd2aa85c5768fbb38d8f86a59599455d9afad12241034698a66c29170b2bc6375b227ae27375142809ff736e5f36c0764e909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
c13f386b29003396b197fde419f05406

SHA1
8470b6a97914b485381f286ee4b8e8a5525a8bd7

SHA256
38701b6a9bf17bb8bb68eb673bed6a04cffb2727aa58c0a047dc88ae4f8efd92

SHA512
e761cb79e31b73d1e628a945b6665bf6991ad7f205beb1505cc602d354550533c3dcc29f63636321ec13e766f83b6233257f11f6a425afc0e88598b1b5bb0673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
340B

MD5
c32f166681915b30f1b1d518bbdbba25

SHA1
aa5c4573ef1cb73c22c79d341eae6bb1384312e1

SHA256
2ec2a8444c50ccc54454d9216d6bc20259eded16f17bc789b8a12c7f1538fa61

SHA512
762a5d9776a4e7f08356eff9ca74ebfd2b3499438766c58fe9f9c85fa77a6159c81e96164590c608b71b7f694a93dadb844adf8ebd7eacbde1c44fd0b2383b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
809ec300433ff10372536c21b1af875f

SHA1
0a79b0d17183d8ce694426bb6dfad9f0bc7d738c

SHA256
92174a54390b38bb1370e77830c5fabe2780f8c791a96cb98073422e6c47915e

SHA512
77217fb398d0a0fd9c7978b8fa6fc484e0a2b209c29101c7f8740a3146e6e8e0e5dbf0d78f764862a688bac8e73d6544b1638ef477b731a3284ed90c4ba4817e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c94490d3df99ba390dbb9592b940219

SHA1
868182b82e863244df53dcc11b3ad7eed8bdaa8c

SHA256
507e8c5d792ed5dfa368ef0f31a4ab67fa525c4596ee42febcf6247a7c292eeb

SHA512
bcbb2d79994216957b29ec5251a8a187e508b809859656173eaffcea1d7d6e83069569cfee8aa630093da8ad68a9306d37777c14ed405da5a4fefa10461d9fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4acbfd6482358b1bd350c7e43ca16931

SHA1
5a444a422695e3e7301133e5dce59e3024b0d4a3

SHA256
1e0da5f29720d28c4d169bbb328016281927f5bf8b8e1df1fde6bbf6dba56f05

SHA512
9a267711a9151a3f434f3fd206ed0d76aded6c714d4e193a7eb4d7953bfcc5a176b33c56783d0c8cb440a90234af67771e79fc560fc8acf73412691a694741b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
f62cdced78c74c45dc3fbea1dfb94f7c

SHA1
f1140c8c9fb9c86cd93d0a3a4b1f185d4cc7f2b2

SHA256
1a1a3aa15038d36f1e3b7f22759757d009e18618be65175f5cb435ca31b1a86d

SHA512
65bbfd4f4759b1e322f9fed54f624012cc3f9833ea1081d729521179a4a0d317ce3370657aa8a32e6bc0797524afcb1e5cd6a6b7178c9523dd891a387d7885fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
c5bb359d4cd5713c4c0d42b61f133a79

SHA1
3de801db341ceaeddc1da444452b906a98aee06a

SHA256
6bace0b937a33a59843c83490b2b7a8a2cbed09d89fca6cd36358823f0935af6

SHA512
0db0f904dff20aa099696a2a275d6c629f417cd1f9eda52ddd441515ebe21bd39a54c832a6c46f7c119769a916b637e1dab36f7139c11aef1c3d5bc88a732362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
1ffdb9b4b68e0200a1629947f9608f6c

SHA1
47ec999643cedb9db372c7a79cb8218eed124dd5

SHA256
fcca0c42d191c2f521387744c2c01a6c386f8eddc0d6604f8679981ffaf2652c

SHA512
2be18430ffec9c4172305ecb867079c1a86f1fa9a8822f1d3f49f68bc64d85d453bd1b852a4ffa60c8a8d9d78f162692d4f4b62c7c3d680fbb0d59ddfd42bfa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
88e8dd5bf0bacf970436ae55bdedadd2

SHA1
724464f18e9f11a8afeb63ffdf01355cecd432dc

SHA256
ba64336f6189f7c45ee071047f564ba4e94692d069a3cff121c9c6932e94f3f4

SHA512
d22adc2ecf753f51de2c492816e07cf1f1e2e4c0e38473eed67e5c4494c46a3f65e80071c37ed34c46f22ad92a5e43b627fadfcc67981eafbeef89f3397fecff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
97330288c35e4c1d5da40d340ee4f511

SHA1
e5938db3e0d3ea40b3fd4be1f58bae41f1aa845f

SHA256
26795fd611416b04c8433c7dd2c7de98fb633bc85ad4ae8d89ed26cafe89fde3

SHA512
9602da90219f1a25521296f605b569353d420ecb306ca98d9a7c63f94734952c8008fdd92f14131bb8b846ae3db29a44685d134be6d99827574c5687c5687088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
20d15c0b8386187b61de2c5249f058ab

SHA1
0a6a7349cf7218dd28da0d888af073151b75a538

SHA256
bcd740ad3a80a985467041f2265e3f56cda405b46d688bd9018beaacf8297cd5

SHA512
9a58bd30ae13ff47ba5a61fafa043773fb87e5e1d4198eb182b84f5e131b1d19acb1139ba2e32a47fa9826864a4542eecf69a206464a27cb006b60154cd394bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58585c.TMP

Filesize
538B

MD5
ec964d8f03145f9b227121197068b387

SHA1
724e704358c28a2c7f4b580a77269960cf9f0681

SHA256
a61cdfb9ebf4408feb3e02de383ca735babf11adb3ea1a34425530ab930a3e2b

SHA512
2d67114096302a7ee0581d5fd98da1b048f57b7b71a7806307e80069ee4778172fcae6f9eeef7bf281677ec4ff630fb05666d4b101ad5462104db0d4884ecb21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5633dd94b1f91e008c8a793a2e5e70a2

SHA1
8144a158958a6ffc408fc9ef97d1589912f95881

SHA256
45f346d87b614354586abb9219e117953006189e69e2490ab7180ba8026020ab

SHA512
bfcdf37ef32fb7b62776ca842415aff9d60ec645049528a8dae4a8342916acca3676a5db7a35ef6282512563ef8c981c2dea14c8ad7e48c64a23dd104dd5068d

Download Submit