hxxps://k93ke2sb[.]ilescuro[.]ru/w334vxhm

Analysis

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://k93ke2sb.ilescuro.ru/w334vxhm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
744	msedge.exe
744	msedge.exe
3296	identity_helper.exe
3296	identity_helper.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1284	744	msedge.exe	89
PID 744 wrote to memory of 1284	744	msedge.exe	89
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 3080	744	msedge.exe	91
PID 744 wrote to memory of 2892	744	msedge.exe	92
PID 744 wrote to memory of 2892	744	msedge.exe	92
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93
PID 744 wrote to memory of 792	744	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://k93ke2sb.ilescuro.ru/w334vxhm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe091946f8,0x7ffe09194708,0x7ffe09194718
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,16590660698756090173,10946176490338854940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19a86f0f-939a-40fb-ad29-1e501c1c1d83.tmp

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
83cce5ef662f6582455ee1dd9997590c

SHA1
e869f385c5178c3dc1acdd434d44feabfb6afee9

SHA256
7c635094b9fd51d0793aefedcd367201f1c402c6271f5ab6cdf209c015b12bc7

SHA512
ddd746ebb51e770cf98cbd1726c71cf85951823e14d93643e50e56a04b143a011f4eac04e35cbc389b945d18171ba5060ce6b9b5689034de587ba45213e7934f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
644B

MD5
2c5dea9d727e2a54c8b5e605e02bb870

SHA1
b2075739618e784192e426e75fbf5a43690bcbaa

SHA256
73ab685996e57eb3431a98ddf4e14d9ba1396a59f68a7841c4d4b761cb3d2116

SHA512
9010bfa412e4f56532c8059d925465129d6caeb9371fc39a53477c113a858c7435e66892c9c2e771f96ffbd3a67b2ae8492c9a3d62b6ffdea0916bb588822356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9202371f02863adaa10b3321fd99e6ab

SHA1
ad4ad19cf0a10bb4797057b99e7c3b1220a5beb1

SHA256
0736baef20df0b9110169bd241377080d709d3d4e928382016d1e381cd7daf91

SHA512
d219c0a8fdec777d46ab848943f80c8ebd488a46cb292cedb4073400c7f1d856cb8d09448ee8c03aa8197a7f84cbf87741be286f7bc3bb17b9d5d6c40a64ae7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b68cd1dc9224360fb451748079516832

SHA1
7b6004636016910aeb6ebe2d9d68ae5e8dfc08bd

SHA256
366aec1fdb5dffa4e7069809075a61f6cdb06aec2682a9d7e9931ed7d6e91b88

SHA512
7ef776379d32bdd4f05100ba90f18cfc367ce8a6e8a1ce9f32946d36122d1df9f5e42af6ef9754df0d0e13795cfa69ae20329b077e7295e3787e1e97331f8ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4cfd608e3f3defbe0325cfad01f79e9f

SHA1
8e9c5acd98dabea953ca0648b4acc3b0f0f974a0

SHA256
f30cf438448e4f8c634434e925dd4a82a8e845ed57ef3b3cfdc5318a26624a72

SHA512
406bc6e2b83aaa37c090803a100e98554587278860f5a2cb22512a5d2cc8ed92026a2130d503826b596772d66ff3a2ed846db5e5e30100273ecbeb377ec90ee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
5713fde2a7dcdabdadc111c607efc9b8

SHA1
8d8478e1d71a825abf644e5ed2c540ef275bce1b

SHA256
d21f8a6475281d7652cb38be31c74feeef4be4a83e5f11e8d29e6a7c276171ed

SHA512
518c3548b62081a43a47d58e9fef2e97d5809d25a5f2c967dc62f361150766160da56050fb51a16899583eb9dce40568d67fcc7ebf8258b9200a161c3a215975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590f67.TMP

Filesize
204B

MD5
7cf37b7f0deca25d7175044f52c914fd

SHA1
7d60b71a345b854a49f55a01406a673a17d94109

SHA256
3932aef52234e46dc5f638b997b444580ddb23f7f654f8aacb47fc69ed3198b5

SHA512
c54519f5dfd39d12a4deaff41821903ba4249ab0337aa6ca08530c2de029bdad499b036d91d83831bef3a60286e5ea1b76ffc578bf9efc3bd32614c74b8c7ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
80b734970516f9cec133a7cbad141fb9

SHA1
37dec4bbc96cfbc282f3e9b2f4b3e8c428b82868

SHA256
ad24b74f417cb82fd4c33507cb1c0aae55072f6c3ef9ff2e98acde51b93e1796

SHA512
46f250e56ebbd226d6b7919e598737555f1823a1880be371e2e9da20e60d085e88bcf59f3b8369c3bb9d91415eb98a7bb2919af11d142421c1488b5b1f24ad2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
01b7c2b743a444731d0ecefba9b81b7f

SHA1
f8ff47db458dc84206518c0557316e396e3598a6

SHA256
e54e96fcb8dce71ef5baf7abc511c33c8f64a6c7d3a9c0b694ee581772dbb63a

SHA512
3a2b69135ecb5a40d1c0e9d271c65fddf7a3794a2571210f6d3c2429013866312cccdd5927642049a962f4f3bd3e953e8060c15c21991e1f3527d5a202c22ed1

Download Submit