hxxps://tasteoftheoldcountry[.]acemlna[.]com/lt[.]php?x=3DZy~GDFVXea6575yw5Oh[.]ah~3-piQ~vjedlZ5jHIqah5H77_Ey[.]0eFw2H7zidP3jfYxXYHEIFai6E

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://tasteoftheoldcountry.acemlna.com/lt.php?x=3DZy~GDFVXea6575yw5Oh.ah~3-piQ~vjedlZ5jHIqah5H77_Ey.0eFw2H7zidP3jfYxXYHEIFai6E

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
1524	msedge.exe
1524	msedge.exe
4144	identity_helper.exe
4144	identity_helper.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1416	1524	msedge.exe	84
PID 1524 wrote to memory of 1416	1524	msedge.exe	84
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 1408	1524	msedge.exe	85
PID 1524 wrote to memory of 3804	1524	msedge.exe	86
PID 1524 wrote to memory of 3804	1524	msedge.exe	86
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87
PID 1524 wrote to memory of 4740	1524	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tasteoftheoldcountry.acemlna.com/lt.php?x=3DZy~GDFVXea6575yw5Oh.ah~3-piQ~vjedlZ5jHIqah5H77_Ey.0eFw2H7zidP3jfYxXYHEIFai6E
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8af5e46f8,0x7ff8af5e4708,0x7ff8af5e4718
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10780741993917975471,12437305336990815445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c7860fa1662d5600cc89f5d12e418b82

SHA1
d09e6d26f1698905698184549eccbe6ea80649cd

SHA256
b87332fbef9fd0ea78ca83a5b6aad8a5a194011a8269bc9637b42019b66e235f

SHA512
9d4850fb08e47ad208be1c18352276b412e8105c0a71e80b2c6f38dbfeede5c80736278d61ed502a5dd4997ab52e94b4bac0af89044a95c98225d9fd6f760394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
896B

MD5
372b1cf50f1b11b32298bbaa334174f0

SHA1
bfd0cd9194380984d74eb44835f8e233ee1c5a13

SHA256
225ae6ddf4cc36f4408d54b20efdb9c55b6984f21b09e6bb0ac84cd245fdc339

SHA512
9e8b3b8fa9f56439a3919ab8e8c3ce75ebcb65edbc475e5b0993ea267df40d2e298a801b351d3ee69aa7cbe95da32eb7031aab39d4bd6b83ad5969ea2b92e7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49709854b921c99060bed9aa912e29a8

SHA1
149417e2ae16051f202e8dbafb65b5b80e5ecb15

SHA256
1cedabec7ba6f515cdd85fa6211f838b55f6bdfcd1e030ee92d64473e7a83929

SHA512
5080f1e7e0a17488e9598d483f75ea7b64cc474c0ec4973e12e16d548a333577e47a3390e701a49b4088dc9f5bfbe0948bb18f3d64e705beb9b74663eeec6d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26bea5bd2dafd4e22402bce37ea9e043

SHA1
750c5db328c2a52bce94598b8a5700e29b7f2051

SHA256
a7b298fa88422798cd58b10fc23d8d3a25de6dd22c947a633e6c0bffb330b03a

SHA512
2291e86359cac550beaa0fefd6399abd3a9c14461434c6a1fa820aa0d69f1a1bc39cd708af08def029fdc0bf3c687acdc7e35728598634a1aae738ae2afc8574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
2f63054645e78bf7fae7924e94601645

SHA1
9f4219872a103a684101d388de1b8c2fde2a4196

SHA256
7ed6039265ec41595ff870307143d1c008c664b2adcc6e6774060192f6b56f34

SHA512
eda56ecd486983b19fe23e2a3456f0e8c289700907f2af43c3ee6091e287604013180cabcff43cb474232549432dde09aee7ce9faacb961c03c374a220d80887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
521738232539da371ac4f2c22bea30e5

SHA1
401d8ff8859a54c92e8c901c3b18a25aa2060a6c

SHA256
3c9044af5b8030296b220e623522d33e60e58a432427ea6dc6481f8979860689

SHA512
dba13d499eef57491e76c98933b9c4e406686d0d2cf484b251c7151a81d22ecdba3866b8df80ce639a7d67621ba2e9a817dcd94087e782d44908d3ef5d6b7119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
d0555bdc6a8c8421707dee8d19d09710

SHA1
00f697a9708f8a9469be862024cb6b4c14567bc9

SHA256
1f3423ab8280bb9b6acf9b0515bccf29672f21760b3cd5d04a37e42b8308d684

SHA512
3ac2825083a56def0e825d0445c84d79905e20ba285c78d7d20e63559556b752be00ff9f42d51dbbc477f3168f4f8a9e7b0ed01837c3e0056af4fcca1e134927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
34b4abec90e05b42b172e9dac86fa379

SHA1
0ec07d57f9909a87fb28565778dc0781df1daa2c

SHA256
6ef3ddecdc06f75c4d1832116df7789407e6272ccc3c14a450f0884b95a8c5ba

SHA512
26179f9ceb8ff78d14a05bccab312fc56c2cb8b2f09fdce97bfd62e9f6b565b947ead4a94fc140fbc6a1967dad2038c2a73fa48973869755bb64649060ea93c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
442240b3137faae6b97b0fd4e485359e

SHA1
a4416d2addd496ca1b0f66a69d41947c1840a085

SHA256
852931c2983a9fdd265c5aa46c4899962f4e697d452ee0baeaf389de73f44519

SHA512
40fd738be73f9ecce2c3c4751e87aab5d779e4280a1cffc6cb742099888ba0c02d5b81f5bd900250abc4697d7db13237d99dc11ce7a576f6227fc8f433789713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e2fd.TMP

Filesize
702B

MD5
7d23be456ea0fe4804afd815d75c40d4

SHA1
ea4bd31ae8f061c8d553c7747bc0231e118613ed

SHA256
242c577dcd7ed23c95102280f269139ddef7e06d4b6383d7285d36feb9e0be0d

SHA512
ee3f7abfa02356f399c230a553d686e9fae731b323160b4bde634cf9d13d8764becafc101e1a4df831b287f20d6579095bf693974f4dc9aa7b14298205d5c7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9f931e65342552c510f7bf0b7c703514

SHA1
bbd24de60dbdef735d3e2b3cd5c26dbec612779c

SHA256
c5dcdac0b8c9fddab691383b75744fd050f5e47b26319d8fa84e23106e90c284

SHA512
503b1b457d6d92f0159144272181a342d8e697e9c79b7a53d791e5b2304d4c2bed05f66f22b4ffe8652eda0f2f29b517db4a942dd5318c4e3276a1435d15c1a5

Download Submit