hxxp://amazon[.]com

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://amazon.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
2812	msedge.exe
2812	msedge.exe
1324	identity_helper.exe
1324	identity_helper.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 4808	2812	msedge.exe	84
PID 2812 wrote to memory of 4808	2812	msedge.exe	84
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1916	2812	msedge.exe	86
PID 2812 wrote to memory of 1916	2812	msedge.exe	86
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87
PID 2812 wrote to memory of 1416	2812	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://amazon.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,15329885138286558784,1241240961641667849,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
0d0481db8d1f85a434f27efdc775af01

SHA1
d88b5c3d105d2c73a678cf495bf2b3029349aa21

SHA256
addd1a4e1d0abd64ad183828dbfc8931e365e6a68114d5350be162143a096551

SHA512
7208b48b8622c6703da8915e13b5893457efd8bef983127d00064de55863f29613fc6134fd897dccdfbd10f3b84cfca93ee9035d531115c3d1e2daafe95a4d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
184026925ed1185d2d80b05bb136cd23

SHA1
425ba78169c2214f56243d4809baaa56ce5a1b10

SHA256
ce080deb1ebdc4f80ba2af7fbf46ca71b198a90e3e55c2ccf3c7a842bf1ecbbb

SHA512
85ed8dad861a3d637f67f4de53d702338816b724ad94b5bd18c4c1752b32895443def9a889dd8e223c31f69da5a8f3081ca47f3c491df773791956cd43424f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9a8491ea33a8cf0cad792d935d66ddb

SHA1
39d19f462f66b07d3b5d362f605440acd91b961b

SHA256
cdf6fd96622d311a65d7f205e372d039641d82ec6c39c2bef6a23e0e593d4a69

SHA512
f4e2373a8932bc6fb8f26788f83465f0a2f4e69e993fb5a9014c1c913bdf2c59ef962a54742b35477a8964d8cce10b1144196a2e209cb9481c907a40da035d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5a2f957171cf4c28cd5b7b27cc9a4a8a

SHA1
c6da3ce962fc2b827316eaad18d6ed2c4434762c

SHA256
7082981eb2bcbb6a690ebce37920b7f48ab0278fdb9d36667ed148f244983d02

SHA512
e88467a01fd7828936fecff39c11ecda3447a1f8976a155c7595793da1ff50c707ec6bd7408e6d98bd45e7a130af13a64abd32ccb9475408ebe6831fa1224754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
fbdf4f62334f2398a177650e7deae40e

SHA1
19aeb48d5487b30e9c9fa4e7f1b0da2c397a2667

SHA256
c9331118214e6b778d7b4e86f78dc1f91a47d17d611aa177c5393bdb7cc48771

SHA512
ae64f4bb09339e48ee9631104fa9d191974c9fa010ff19b619c5bfec0817ff6e635024b5fccb8c7ec328959208c0427d5556324a8d4367b5eed12cb34b5296e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57dc95.TMP

Filesize
48B

MD5
625210d5790610c36cbd31851ad02186

SHA1
0c5558746df9357885071b526e19f86763d079ab

SHA256
22fbd83cb4fd07436e72c12c88137beb8fd0a228f173817f326eb8b825339bda

SHA512
0c8596cd6d0457a143f502ceac478177dd60f4cb37369221477c62f6aa94e52e3943f8f7770bfae03c372f7e888cdc53057eb02b1ecc9430f3c37abdc003e611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0e1fc2b120ca0fafb766687f31c6eae7

SHA1
e1961940c0ed848c07fddc7de2c82c0ebd7771fa

SHA256
341edfd83863ea9b167b1c272a84c9d32f240f9a75fae64763c1701c921e0bf5

SHA512
7bf686d877058c198de0c5780b9660933396f1da4e2c8fe079b74d1872660f2ecab5e3338212c93c7e32fd68701bfb2f0a07204da8889a734143b64fc66a37ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2d2dc7b6da24dd47ab1f0791bf64f69c

SHA1
ad4d2e942a3de4682cceb87abfe5224288827451

SHA256
fb8d27a471240f66521a406aa77f7d662420243f796ac6d9470cdf0542fcf051

SHA512
6d7d4cdfeeaf357e4cd40a7284191c34fae95b5e4c0ea6737b6718be8a31889f4e53f7ac7a2c1fbbd51700a032d2827c8f2a1e73d5409828e88db44d1a3e6faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f0845a863303024548bb9e3791945b37

SHA1
2d0b714521c5e883ac7ac8403bde3355fba4751a

SHA256
9c8cc7ee8ec6e408012e839c5fe2ebcda44c17fcdb2b30a5a6fc5086a0d2e400

SHA512
dc003c8d5e4c3fdb3ad22a3ea9d631a7a4371470a5595e60a9ca65652c467da21b7c0d0508eb892bcabfef4f962663cd8c6b6e179c40bd893fbb6b01e7c9289a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
692e876beeaf6046e3b4dc36e542c787

SHA1
868903ea430b1a5d2f859b8349eedcf90a00f112

SHA256
9eb7494de17bd2f8a24199c7760f085f05b7f34163a011405c856106a083e2be

SHA512
c27c611920e58b6fe4f2972b12a9d0ff7cb7b526cb601ab59b1f1facfdecce21d9abae05799f700209d0efa4c41d53dc68c974336039f121b307c65bab238fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8e7fec7be0da6dc0abef99eb86ae0233

SHA1
b92a790c59f28ed2abbbbcc364b9561bef263971

SHA256
df7b4a4c1fdbcfb6180cd62611659c7e4982cdbdf2d54eb58324288f4d39060a

SHA512
273c755df329014e43acca3dcadeaf3e5b3c6ca44c4ddf91fa79c03bd61e6e17d742844a96a84c26b3249576a26e9e9a2670c5331a0c2115023356b68a7dfdd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d2c1.TMP

Filesize
2KB

MD5
f3e5782b98359e63ff324f9c817587c5

SHA1
5ef5561d7d94041d1e1933a60d18305d13437bd4

SHA256
03f9b56f18118b9c46cadfab4be58910c8d182ae6b930954e37a500deb535754

SHA512
e5877d33cfcc77cadaef0464852d85d6c298ff8457e4306abfbaafa5996b4d7e8a786d8365913eb5d2a024d1adf6321ac2945a72a9c42a272739b215b2bb5930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
435a79555a12cd112ab37189a8a16099

SHA1
07210ecf4e96ed52ec8c0514951eaad17e048cf8

SHA256
89448d6d1a3392df0160d45d2a990af07e4820762e0fad89a8685ad4f6f1fc05

SHA512
14140a601be0a777cb124104adc21a8348dec260b26aaada1d41cf3278e3ff4a5a67d138dbd29e926460dedac0759ab0d32f798fbdedc0638d8f1ca2a28cfc53

Download Submit