hxxps://secure-web[.]cisco[.]com/1Hrr4pExTvKudPe8j2ShaCbkJfx1p5Oowu5btrmKVfmX_D74x0fyJP3jSrqphl96Aj3EkznjPSnc-N01KRz7Z8IO0bMyrL4YSCrxnzpAJexSj66BWbg2ZLJkBXw3zxSRYqhB41r_H8OMNHONIZH2gWRJRchW_gFG66gxbPEmy2kQsU4TZWEJWQEGDKgiaKhM-tTfIw1AzS7ogNSbrdyoeOVTW-H4Q9G-tajIG4BhjvZ_n6rsmuvN0oPLR47E88Ej_3XUZ-sa0LRAWZyeLulgoLw/https%3A%2F%2Fdennis[.]i4searchgroup[.]co%2Fapi%2Ft%2Fc%2Fusr_DGR9t4bEaz3LBRDnr%2Ftsk_k6dBY86uxajskc5qD%2Fenc_U2FsdGVkX18_J7uTqH9hjH102p1p9X7HJwb51I029QsBMb_PlK9tCjufp9feNROa3GopBlDAH6mGoNnM1e-_p9flH-cLl9A6fzkxpzYJ-Kw%3D

Analysis

max time kernel
34s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://secure-web.cisco.com/1Hrr4pExTvKudPe8j2ShaCbkJfx1p5Oowu5btrmKVfmX_D74x0fyJP3jSrqphl96Aj3EkznjPSnc-N01KRz7Z8IO0bMyrL4YSCrxnzpAJexSj66BWbg2ZLJkBXw3zxSRYqhB41r_H8OMNHONIZH2gWRJRchW_gFG66gxbPEmy2kQsU4TZWEJWQEGDKgiaKhM-tTfIw1AzS7ogNSbrdyoeOVTW-H4Q9G-tajIG4BhjvZ_n6rsmuvN0oPLR47E88Ej_3XUZ-sa0LRAWZyeLulgoLw/https%3A%2F%2Fdennis.i4searchgroup.co%2Fapi%2Ft%2Fc%2Fusr_DGR9t4bEaz3LBRDnr%2Ftsk_k6dBY86uxajskc5qD%2Fenc_U2FsdGVkX18_J7uTqH9hjH102p1p9X7HJwb51I029QsBMb_PlK9tCjufp9feNROa3GopBlDAH6mGoNnM1e-_p9flH-cLl9A6fzkxpzYJ-Kw%3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
2648	msedge.exe
2648	msedge.exe
248	identity_helper.exe
248	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1332	2648	msedge.exe	38
PID 2648 wrote to memory of 1332	2648	msedge.exe	38
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 3404	2648	msedge.exe	89
PID 2648 wrote to memory of 4212	2648	msedge.exe	88
PID 2648 wrote to memory of 4212	2648	msedge.exe	88
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90
PID 2648 wrote to memory of 4232	2648	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure-web.cisco.com/1Hrr4pExTvKudPe8j2ShaCbkJfx1p5Oowu5btrmKVfmX_D74x0fyJP3jSrqphl96Aj3EkznjPSnc-N01KRz7Z8IO0bMyrL4YSCrxnzpAJexSj66BWbg2ZLJkBXw3zxSRYqhB41r_H8OMNHONIZH2gWRJRchW_gFG66gxbPEmy2kQsU4TZWEJWQEGDKgiaKhM-tTfIw1AzS7ogNSbrdyoeOVTW-H4Q9G-tajIG4BhjvZ_n6rsmuvN0oPLR47E88Ej_3XUZ-sa0LRAWZyeLulgoLw/https%3A%2F%2Fdennis.i4searchgroup.co%2Fapi%2Ft%2Fc%2Fusr_DGR9t4bEaz3LBRDnr%2Ftsk_k6dBY86uxajskc5qD%2Fenc_U2FsdGVkX18_J7uTqH9hjH102p1p9X7HJwb51I029QsBMb_PlK9tCjufp9feNROa3GopBlDAH6mGoNnM1e-_p9flH-cLl9A6fzkxpzYJ-Kw%3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80a7a46f8,0x7ff80a7a4708,0x7ff80a7a4718
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,8265077791763352714,2180916116895436916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ab90b995d2b21deaf852debda64ba31c

SHA1
5386ee19baf12b4e5565c8d49bd62282956446df

SHA256
98765927a71a7e8211d6f3226fcb9b670041689a5773bc45b739616b7c1fdc86

SHA512
29e47fd3c6bcc1b2fec34d02806f1d19cd648a99f44c3c4fc73c2c3db3d9f3a986180b2e27d924eb9b37d983f16ec5e8ca79bbdd581d8fc52bcd7d8efde51210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e98f0ffbdedca14a29a1dbc14dd3dd90

SHA1
42c32ecc620c768d979eb3594aabf6e51266d9ad

SHA256
85c19a2595a08bdf71e383de6301a9c0df7ef3b0f0bd028bb21061674f9fc38f

SHA512
48a7ceefeecc47200b42f70dca2c08ac0db09e3922bd38251a0f0a22f2d3546c29dc88a55867947c895547d60aa367417bd5ffd6a3d19dde16a6d34a307c981d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cfca27091eea646ec2654e4e7444066b

SHA1
17927ae30e27cc38e147a4188f672b432c719fdc

SHA256
f3460495f51dfe748ec347c2ccfd33dac8a8e9ef0813bd1179bbe83d6eb3085f

SHA512
1b0753cd29713d02af82ce92d0b3c5e46f6dee3800a734e99d58a0ed92b589a96159b233cd8c0e69b31b0df393e19adff9d2a046256471b8649cb06995cf369c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
fc03b585f0d999aac53c1dc1eb0c1e39

SHA1
6cc8355d0335c091fb07e136404d6ba097b70f0e

SHA256
f0f299df554129f7456303c728bbcd7755505a0a6426c561f46178a1da08856f

SHA512
6b858fe671ce6e340783c59935d1234244679c1f2df4634e17fb496b250c90b624eb03d16751515af78cfac500e188c9ea41523a7a4133a2cfe6f8ae790da42f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815c5.TMP

Filesize
371B

MD5
9fb3452c231a783ef9aa5849e565361d

SHA1
cffd76678e7d56eb8874b78472738d1be6571f49

SHA256
0029a981944b1fa234ae2165b38e494e68eeb1c62b4faa4c504bcac1d83d562f

SHA512
dbf518c141f10b9ba37f8f292303aa888987c8613cc179a499b0df2a83e79df6940116f658b5fb19e36446941b8a7a124711922854e868df2fabf1db9d31bbff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d8db368ac402a9a0f481aaf339fff3d2

SHA1
a54b0aa0cf115eef44a520bff0b406cea621efb8

SHA256
5c648c551dd8af1fa9cee5a89447971ce1398a1deb57f751f451c7cdca5c957d

SHA512
c87e0ee5132f2577188ac4c327d44023a9ffe36cbba2539258dd5050803d4f4c59ccf2a927aca6791bc2ef99afbccfbac8ea7ec7c0911209afd33cc2dcedaf6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
586d9118a14ba88efe9a86a50f3d9cca

SHA1
0bbe8025842cf1014179238e8052538a31d2c11a

SHA256
792acab772a0ee05dddf243bdb12ab75adc7a655a29a4ac22b3d79b37b408cf2

SHA512
2db52259a6e9d0983773ca4afedd42b66b5d2bfb3c52bc3dfb9b6ce7f98e899d943a34c99ae9a8dbe44e5d206335750a16c3c77278ed79df805b3213cd308c6f

Download Submit