hxxp://cmxtravel[.]net/

Resubmissions

16/05/2024, 12:02

240516-n7lapsca69 1

16/05/2024, 11:59

240516-n5s8jabd7z 1

Analysis

max time kernel
1440s
max time network
1501s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://cmxtravel.net/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
4276	msedge.exe
4276	msedge.exe
2984	identity_helper.exe
2984	identity_helper.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4052	4276	msedge.exe	82
PID 4276 wrote to memory of 4052	4276	msedge.exe	82
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 820	4276	msedge.exe	83
PID 4276 wrote to memory of 2680	4276	msedge.exe	84
PID 4276 wrote to memory of 2680	4276	msedge.exe	84
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85
PID 4276 wrote to memory of 4904	4276	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cmxtravel.net/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff089646f8,0x7fff08964708,0x7fff08964718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15659037471617899347,3894842375086270917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5616 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
f7e1429bc1f755d9f2e3ececbd19f023

SHA1
168cda24b9f0f21c155b68089aa385739f227f75

SHA256
27a896e8c3bf74725b8d7c16a006affe595bd194fff5aab0a6735a453e48d8f8

SHA512
6703f3f0e3556c4637e611f57eb531f7a2819a6851965d1ef35109550e64a9edacded788a47c19eca2ca94b6a4f34a65c9322a4a72e14ee5fe309637b9c1d1db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
05ae837e8b8b1f98cd82b6602b7bbe6a

SHA1
165785d4cd95b694cbdfbb9810bc210dba414de3

SHA256
e88bdb20cfbc259c4e5c0ab1cef59058a0dc407453ac12aea8b600c41c76aa1b

SHA512
2c36958dfa8ddbee4b2bfb057b264d6d1133a465528f067d04f9c11cec1bf4029e382fa4fe455b70b1e69b3c74c5caf6f26730ca6b7bd73ebaaa177fb7ccfdb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4c4badd56f5809be9d07d70bd76c3c51

SHA1
352560d6267d2c710427f678e960424fa652040f

SHA256
80bc0606250e82bfa4b781193943451a3c4c28584fcaf82858f1b1661b03f5c3

SHA512
18443173e906d2cab2d65410c737627d61f1fb4ccd7b70ff105c633e7a0597781a3581472a372e34b805a6b6ae5f40af26d9870d8ce07a7e295f0a258e40a3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0771355531bfc0b09a83cab6fe81e274

SHA1
c18d41d8dafc7b59d576e1f99a2b9413bfbc6ea6

SHA256
2fffce3283527a230e402cbfb6c138a996aac187c351a44a7ca38b90c7f5aae6

SHA512
642a56a2a80169fd10d2c5df2affa4e48d9c9d5061ef89737017890f783ce5f9aabf569a6cdd121417c92aa74865a470e36c0d50d21136d4a8b58a1b4fc54cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b45fb841584afc90680670feef59b69c

SHA1
1858151f8e44b84859d410cb3d7938b99d4e06f1

SHA256
989e62c4a27189d807949386c4b3355ebbf951efe90812d61aa29e7800b378d6

SHA512
04ec56fb35d427423257d60de65964ce2037d0dc394b4b6903c9ae7e8b445beb89e9c4805bb136befa5395aa8a1a39de138ec029eb2a5e6dd4f733dec0e25d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
a52507546d36cd9613aec0df891c1d6a

SHA1
0905d7ee21448d556bf4750837e4f51e62c159a1

SHA256
89567787f2d34607ba0e47668c8e86304207c4cff851b9f79fe6027180dcd6cd

SHA512
07bf78bdee4fc77294324d86e252ebbf2bf2769264941fb99482b042e9300e7ce3fb91fbabbc508e70ea729bc622d6ea3c81d9650c7a4f7846a3239cef218c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
78601d130e75473f630e9bdcb8226b4b

SHA1
8343577322bc309f05c52e18c4c2bac8a855ded1

SHA256
cfa74932b4aaa13756b6ce88c1e01d41a985b3a9b7a76f54ad9658952ec1fd5f

SHA512
1d7c654915e7ed78bbe1f4006748b750686e935707a20e20bd5ec36d675e766cab85b2b0c85a1f0a42908ce5b56865a02f0705be1a554e9fb39f80d10e326c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ab53.TMP

Filesize
535B

MD5
4aa2957e5b5d1af993b22f0fa9d971b5

SHA1
592b46c5f50ab4e5a81975206aab11b3bbbd265c

SHA256
e3a98fd8674d896d4bae1848872ba0325b5ca6c81c48503d32e65a46e2a9fea4

SHA512
10b094a93b2f47764ebf5f93965fe93f2ca2fdcb8aac34f3b29d4b2797739b2a59e848e3b6c51525c3b7143b28a10e06503261145574a9bb3e8b2b4f93521b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8dc49c0dedb57b4b09e1ed618369fceb

SHA1
fba4fc7f0e426b2e00c6a005aa0949667fc23d16

SHA256
5d4cbd6b1e06a80878d775e016f67694fca245726fce8fbb22f08ef863092f1f

SHA512
af45047cf722e1c924045b5c0c41ef6159085e7f9ca391d0cd560e6e4da9cc67d5b7f8858476738d8f12ccc8b0045ded6349aa495a5673f73ab702bb745a73e1

Download Submit