hxxp://Gmail[.]com

Analysis

max time kernel
298s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/09/2024, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://Gmail.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
240	msedge.exe
240	msedge.exe
2456	msedge.exe
2456	msedge.exe
2640	identity_helper.exe
2640	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 248	240	msedge.exe	78
PID 240 wrote to memory of 248	240	msedge.exe	78
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 792	240	msedge.exe	79
PID 240 wrote to memory of 1772	240	msedge.exe	80
PID 240 wrote to memory of 1772	240	msedge.exe	80
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81
PID 240 wrote to memory of 772	240	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Gmail.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9d2c3cb8,0x7ffe9d2c3cc8,0x7ffe9d2c3cd8
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4544945822695618996,13624645191548033001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
13ff6977a6aec87858decd139f6e2add

SHA1
022babbf0f80d7911815f5fddd0cea284fdd13d5

SHA256
fe153df2040696cf67b97d5aac9433035aab83de18be4a98d63db432347674c6

SHA512
d776b45a6b430ddebdaa8a9b4646f5124c80898bbc0d4b123276cb8f8afce86abb498a937dae2755af1fbe2d49417aeded85e50534b4d4e1298f177ea4cc540f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
d6777d0e6131d348f41146183b6e68e0

SHA1
464c7aa5442e992ca18dfa321b851845ffeb32df

SHA256
930750e03c7fec41467d9e043b865c96e22075c5138fe8c99681b14f67848466

SHA512
c7855ce21d08dde0ba5840472dd79ad34da68f1c489be381b09724e1904625240f37259d5e858c41c9cc8a0dab8bea911e3e8382548aab12e8d7e82586c9e6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c6e8755f686daa36d4991c18bd8bd476

SHA1
99a294a8f52c034cdae152ff7b7f10060474ea5d

SHA256
5d4db6f803fa8636b47c2e7add75590c4d7fbb183231d9065a22fe4d88942f7b

SHA512
d7393325fe41cf99220b5b2adbc24f8dbbca7d0d680e965f5c153b49fcb72459e173cdd2964cc209102e5c48fc294b8fd9b5b7e85c1f1a3f3d5dff1d6ac2083a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
67a8fb61c975ee6c92769816aec28f55

SHA1
9bb10ef63190d651caaa43e0529a05cafa8dd08b

SHA256
3029fd04ada3181fafb570fa63633e6722ded0586796af9d7b10244ef7b143f2

SHA512
f3678019bcb617e4c815823aa3024647f43689d3ff4659d86a1b57636932631d669869c5a5889ef5b765877ae5d2b92d24ba6e3644c5740bf78c95507c7fd7c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8da532c42012be510ef02f73c5df78c

SHA1
92aa08257954d7d6416028301aa8ba217cc73530

SHA256
98be040c21d1ab5915e88a47d272cf99e46f5eed9739e63f152360bed4475625

SHA512
3d60cc1fc88a512867695b2ad2539bcb3d5230cbcbe0fedcd52d256c11222cb92f40173ead340322a32e81a12544cdb87a9de2033fd154f3b6c7689b508ff7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b0f168eadd27a344c879f71002c2773

SHA1
1d0f4eb5b0cbe05e04763121a5fd63ac3ca165c3

SHA256
5cbcae998eb4c1dd6d3039081803d58d4f691973954aff5b35d9b8ada6bc65b2

SHA512
5fa97ad277685738c589b4136a083becbffea203a18b7b73bf1b88a0a2f27bfa98d853e2135cb3ba9a9a7f874822a7aae881200229ae29475a7f3df585495df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99e1ffeb48ba3a87996a1b24717b1d89

SHA1
550a841ec3a8ffe764c2529e15c668601191890c

SHA256
b48e18a9a1a5e35c9547299626a51d83022ace24d01c3cb7147093785669de5b

SHA512
0c8838300fb5f1e253f4157bef556b48a61a03ba730eec981acc38bb5ff8d8732cb0989c1257c8b67c75dbcd86279fcd45e476f37c7b2bfc30802aedb937b04f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
bbc00d2011e94a6979c369b39ff08316

SHA1
0e5aa5c987d2ee4570261c138035fdd4d86ec480

SHA256
2a6a28d4dcdad1a8a653f4e53030589ff1f580e52eb48843170feb25b03d7b37

SHA512
29023811f0c102f541d5c4a0c602f82a22f38e482bed90c2008a8b7594bc28a251cd41ebf408a457bde37a5e7a4039ea706e92ce39dbcb929cb2204d883b6b60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
df7d7146717b9bea0faea731b37ebaba

SHA1
2d74e80e84f748765e5eb80cc2ac5743958ee064

SHA256
bb71e9e595629053d1f4a8d755eb9314a9a4d7c7336595295537db0b405a191f

SHA512
882a53e3f21175eea68193182682119d06d609559033789fd5269f3961cb8782ad3c61de928022a51f8796ad0bcfafb76f2e06d526170a4c54881c45aaa1c557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
358e8bc21276ffc834aa5c9e391ac342

SHA1
08567c0683906fa466a63a382d8d9626a808552c

SHA256
81d7c69a95e168b2f7bba101802110ed473912e9a51ee0c41e3959538f3eb529

SHA512
d30e09f2e3ade23557e32a36e63ca11eb093854b2161c36207a5263c8d854a33066f46cb5c628f0288c648b34c9657691723fe6ebcf6c4283cac6476e9efa687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
c464abea4eb9ddfb980928aa4e594ca3

SHA1
d54e51455dd7776afdd4a4b59204c16b569e203f

SHA256
ff98704c45151993405dcdb7b989da7a35cf8e453c83b68e60a11f2b5fdec126

SHA512
739a208a73d78b6e1cce190ef993f392175feece0f3173d71d9af68fb9e0efb34c584dc9fb08b180467c08caf35427f07af77d8a71e337a81655bf5ea190e232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f656.TMP

Filesize
370B

MD5
e1998e18c4f4ab2bede7402ee701a521

SHA1
52641cd49a1c53607b1bce2150baac8ef8d10330

SHA256
801cf956b3fd418a1aa75693ad80db9e0e471c3b58ecd84b98913f91add468c7

SHA512
39f554d0a09f00de7e4653130aec67fa3f607b7df438e8bf4bbaaaffbcd30d5beaf7b281785926bbe75885fdc5914a6d51d019b94d6f8ece69c7b7da4f51ee0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0a2628f3221b39ae0014b8b844f99eba

SHA1
36fc7fa73145541b5a2dd7b3023c454d852bd629

SHA256
228b5b7ebad79cf4ed5239e0226a13292af547e1f3983a2d3cb4c6278cf64128

SHA512
c530b2fd18fac2bf0a2f48c60a8116cb04e83f30c6cfd4f74354fe03b6663c775c863ffa9d64ef2463fc5b73a1e5d55385f5b2503804dcaff8dee197d1af8307

Download Submit