hxxps://app[.]hellosign[.]com/t/2d53eb067af6e4220aa1d705e3ab843447701b12?utm_campaign=multisigner_complete&utm_source=default&utm_channel=product_promo&utm_medium=email&utm_content=original

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://app.hellosign.com/t/2d53eb067af6e4220aa1d705e3ab843447701b12?utm_campaign=multisigner_complete&utm_source=default&utm_channel=product_promo&utm_medium=email&utm_content=original

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3920	msedge.exe
3920	msedge.exe
2548	identity_helper.exe
2548	identity_helper.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3144	3920	msedge.exe	84
PID 3920 wrote to memory of 3144	3920	msedge.exe	84
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 2748	3920	msedge.exe	85
PID 3920 wrote to memory of 3500	3920	msedge.exe	86
PID 3920 wrote to memory of 3500	3920	msedge.exe	86
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87
PID 3920 wrote to memory of 1796	3920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://app.hellosign.com/t/2d53eb067af6e4220aa1d705e3ab843447701b12?utm_campaign=multisigner_complete&utm_source=default&utm_channel=product_promo&utm_medium=email&utm_content=original
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb12246f8,0x7ffdb1224708,0x7ffdb1224718
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1863819177526913312,11102969543691037134,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2ec4fa2ee6e54cc1d4d5db7a2fc220e1

SHA1
b11a827c93a4d2a8ec7c866c0b4e4c5fe744b088

SHA256
baf5ce239f8b1c186bd02bf38c9679cf724c8ecd75fab845ede8f106a73dfed5

SHA512
c30f2a2972bba169b903204ade09d9a6ab00652cdc4e8dc64208ca08f17c43bb4b543f0ef407f9f14f78e166078f350c2e192d19222580323b6b02c21c3257bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b4d38c2b9986305dfbd62eadbc785488

SHA1
8d4ed2159ededa5f45b871dd9eaca5901c045a54

SHA256
f5751e69cc3fec034ce8d64e149b5f1d0adc2d5abc8f563fb4c4a449e272d5a4

SHA512
0a932258029c00c9745f7387cccb4148deb87882a37a9a34c5d428d9d2d3a50dfeaa55f6ac7e978b89f1061ca99436dad7702a7d5e2d8f6e02c0073609fb0279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83b669d06770b8797bbe211cf23c5cf8

SHA1
0a4c88f99654bc4397a610e3207111bfd2990963

SHA256
2178842430b64b6fcc172d600b8619c49e7acdf57dfec2ea112b9a53a97a8b84

SHA512
c59dd3724517495ad6e049866de5a2d13ddc5abac0789e129ee781b94bc9ab631fdb00ba039ff98446ebb9b865189d46cb74f9f4913d454e6931d7bc60109165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d9e7b50b3fa2083cc4f54d762c8bca5e

SHA1
953dfd11082c6eb0abc57be96b810892ad714dc8

SHA256
d324ce9c357db24f6677bb1f5950c0746d600eb50c47be507c22a5491c968a2c

SHA512
28a827354917ff8b743b9af78a7a513f54a525c8d313aab88fd6ea06ee397ebd9b3945316291a991834555d1dfaf3f2578546a6d4bb7b9d0896955d659394276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3d6b241881814724a3735a331bd5195

SHA1
79d4757384766c7dfe9d8b3e8bfd484bff62e9cd

SHA256
e48a1858223c3d8e3c4b2e2f39e5fd2473da480ea6e0babda68bc699cf67a6a0

SHA512
a4edb496e0e9f2beba34c016dfca0319ffc6be3309b4dc900375cc3327a060ec11bb9b9400a0c4acd2e920fe49b5c4306a527b8049733c6aed1e810152d1fdbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
80b367bec318bea6a533a67ffb2d1859

SHA1
b44e1d785d3dcc12f3e37465740373cfe804264e

SHA256
8fa691dfd7522d29428b8d01f41f69a68f125bc987dc3534e6f4bb8caddb49cd

SHA512
9a0bf87740bf9384cd21a9e1b3f5f251361f6776ac5e0062e6aa4d92b8a2d5bdb11bc264d3c17ef2e6584551dc5d6841009cef244b64e5cbdc9fe18c1e0f1b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a936e440265feb1e3aecf954fb4eb18

SHA1
df04029e244f1f1cda5796b06944ebc20fcfb210

SHA256
faf22bbdc3535df41a0dc4d1ead3054fa4dd75c2bd780bd1d4da2a5cc2c7a848

SHA512
edf1170919732e5ba9484f74bf1d9af625ef34da7bde02112e81960483cd10a8a2adcfe3d5b58a6057ce3b34fd0bfc8a5f8886561006da1f176ab26b17fc229b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa39adf1fe7d0b226e0f20e5f7762f83

SHA1
dacd70e09ef03832a1e42d418bc61b946d1d455b

SHA256
1616bfd4212259dc506e7476965a3db49a8a0fa07a9be82c39aa1d8b2afb4cb3

SHA512
67f1a6fe7a255267a0d501c315f1078268de0f535a78f59f9e5a0a99e9506e5bed2df55bba99aac7c28fb3f4eb0d062f25ffd3c88d1f1df6f3efaf80438b08d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a457bec60deea89c03b4c644cbf023aa

SHA1
3763ec97b286ba8e17cdb5168419b72596f2c4f9

SHA256
10265ae65ea71e7c76797b764c6811f686c23317edab1aaeaffe1718d1fbedbe

SHA512
dc23ada6595d25ca2503185a0efc94190ed1a8202a693a25c22426c73ad0074925c4d7d66beacc1371a195b1a3db996d56193222906a0c2bab73a57a471d7120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
83350d333b8abbb73a6acba257eeed28

SHA1
8890dd594ae97ceb8f79015204a30e6c59690bd5

SHA256
3ef09608118e0e57a77961a8d51cb505ac348a557fbfc40e4b10427b47f74e67

SHA512
3cb5cdf6db164b4200cae2e934d61ffee90b59625c05441fe9458515e2680898e746aee66e92807a016b0478eec62337b2554e57941c32c3799c3007ee7fe904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
271def732e930de8b05623b65b41ee65

SHA1
9a22e16f1e553cdb1265474bbc5e05ff00e6fe26

SHA256
a6de9151502f34ecdbc6a81fc67f84fbecf9b26d8933a5bccd6f33e1c2398edd

SHA512
9ba771343f91aea6a487c39d3d344b028d708c5daf0ad2b9b1fe3b570f46d33243ea91d1961010dd61363a7bf6a84bceb2694eaf8591d4b0cda2ce666c027b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581633.TMP

Filesize
1KB

MD5
24e4364811391633308b745486c2bf28

SHA1
af70d57a7c78d9112a6ecb164d7342c0d1803ff9

SHA256
905b414731a78f954c833da7293829f73b002a7219c8fac13a430acef37a1cf5

SHA512
e7db1d799f3f9b88e85606f9b4304aa5d9f0ee869fa6562f8ca5724e8c7bcd358abecabbc5fff65b6fab4e0389d1e968ee7edf39b49d6894a110763c9ae41a5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f3fa1e14750242298952aae536cb55e2

SHA1
0b5659d3b2f3851c34bdf2016404111830669ab3

SHA256
ca1ef9eb925b04ad6611decf96b869b64e0d42db40a22605649a31b084898e2e

SHA512
b149e7cbf6b0ee8102270793a1696b6433a842fede334876637a37932b5c9bd2794b7fb7149344f440ccea430c5ae8e499fcba275bc20b847b72c329620a04b9

Download Submit