hxxps://bafybeicbnc4onhibjnkwb26n6ps3pydiu3yste42jsbxu2tz5opktevflq[.]ipfs[.]dweb[.]link/original%20wetransfer=1[.]html#[[-Email-]]

Analysis

max time kernel
160s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bafybeicbnc4onhibjnkwb26n6ps3pydiu3yste42jsbxu2tz5opktevflq.ipfs.dweb.link/original%20wetransfer=1.html#[[-Email-]]

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
96	api.ipify.org
98	api.ipify.org
100	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
2272	msedge.exe
2272	msedge.exe
1260	identity_helper.exe
1260	identity_helper.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3092	2272	msedge.exe	88
PID 2272 wrote to memory of 3092	2272	msedge.exe	88
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4368	2272	msedge.exe	89
PID 2272 wrote to memory of 4652	2272	msedge.exe	91
PID 2272 wrote to memory of 4652	2272	msedge.exe	91
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90
PID 2272 wrote to memory of 1980	2272	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bafybeicbnc4onhibjnkwb26n6ps3pydiu3yste42jsbxu2tz5opktevflq.ipfs.dweb.link/original%20wetransfer=1.html#[[-Email-]]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93f9346f8,0x7ff93f934708,0x7ff93f934718
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14839108263178283066,17840865417525388049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61b77717-9600-4e99-991e-1ee0bf4ca5b1.tmp

Filesize
5KB

MD5
a827e48934a23308637224c119553f5c

SHA1
6a5f9bf7fc0fc4b57229f9c551c053ec410eff5c

SHA256
ae7ed24130853235c0cd45de5d361076d996a52ddb64600cc98c9174da5f9fbf

SHA512
fadef302d45332648ea1cb65b4714b513d5f6d4913a9ba637ee13b7c64e47011f12a99970113c0e0f15f9a55a37a8c799e1397e73f52608ca5615ad88b9e7100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e8a24c2093ef3ac92aec56659e0b09b4

SHA1
38c5de28ebc9da62c83c76b4b965ec273c49ebe3

SHA256
15ebc9f6190ad9dab66fbcee117450ef01343d7cf7142c0677e1362409d76dc5

SHA512
65c5a4557dad856e40bc5e9a92ada7954aa733e0366512fba9e1f866fce8159b323beaff651524cebc217bb49cbd19729c4425a72db388be3a872ae325f767b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
22bef4a7efaef0d8af68bb2c17e7ec30

SHA1
17a8da2058aa347ca203f0fdebf58d385ba098ec

SHA256
2cd58c87c1c3e35cdc4712fc025afe6f07def9b56e7eb9714461b4817f47205c

SHA512
6df1f60ee4d808308277b67048ac75b562bd918440543faac73050e44eb50ba7851425709e97418eb6cdb92e7293270982d34e5a8e4fa1100fb1252b6d798c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
013442462e31b87a3ade1ec574019ac1

SHA1
bd6fc7921625e0974e6f270f1f44b16a74dde4e3

SHA256
e1bd8d42673dc61673009820c9f0532b629678394ae01dfbb6506693da6baa1c

SHA512
08b8c14f59aae2616eca38c18d44a50cdfd888b8978501aa8fa201f79bcf3729555f7a28e7013792937e6138babbdae26043b046853f4c3969c68b8a2c04af43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
580e067614856487c4266bfaaf1ae550

SHA1
2e2043a33368ea8a9c74ab61b160606b79c758da

SHA256
8d1f4b68dd5170a8a1d918d1495f4d9b2bebb6599063c8998546ccc9ab828aea

SHA512
89aa4de6764d6ac1acc53e4762d762c0543ef2bfd93216b47e536eb9e8bb87eaca05e96d3f421bfdff6355887c3695f21c19ed8cd21b3fe8e8e2613ceab05a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb4c5db2c2dad9a498670d4fe40a0da2

SHA1
c8fd20c265fd3af4751c3fd5af8fcfa9d476cf99

SHA256
9e39f34ed2de4476e040bf12daeacd69ff5c9e965c1b7069f82afc4e4265ffba

SHA512
835ed65b2da38b3001e84226cb62be2ae1aed6070bd17b89bc8c69cef89d542421d33f790c7cf27e87903aefef4211131f99733b680e4606d15953f6ae90a1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00c5a4cacc305d03e809234ad1f18a5b

SHA1
0cf020f762b9783fc6774a793efbfb0343668ae0

SHA256
0f5523b09658f229dffaabbc36353cc55dc55c5ba56397b404ac45098b823aaf

SHA512
7d5e5495f70296d1c32be61b394e202c568463e962b48ebc831cd153196eab39708559e8a7a3217e77a1f3c64bed10486a03075b9c294cd30a2cfff207c672c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f0407ec4ec3bb49b1231cd716d161f27

SHA1
aa4ce7ba6b161ac13d54de447a6a2a984354b365

SHA256
c8f220545977cfc836a9d3a1d9543feb26e18da5bbca77543a5dd781b0e42ce7

SHA512
aabcdf80fbd0991bd8068a03402539f511e4c6283bf381d530683dcfcb9138752c6653a6ec57c34d4ee1be5374d5ca0adfa088acc632d75ad8454c62ec732651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c1037b6b8ad375a31a31c4705b00bebf

SHA1
60664ade594cda478e6116a5634a46d8eef6af32

SHA256
f7b1a687000720ad2b70c59dded1df919aed6c6a605030fcee0448d237007b3a

SHA512
f98f385839c771cfbd0c7f5cd3636be43482733788d6b93a1f0143f6c73bd15ebeaa43e0ca2ec122e13e3f7e8461182c6f6e9e57969c00bc5f6a01369f950e5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583822.TMP

Filesize
370B

MD5
ec2da747931ed0584e2564ef8c31671e

SHA1
5655591aa2bec5b799238ba02c8d673876600de4

SHA256
29fdc8a9e31d154c753ab8816c2dd6444ceae0184cb08e4636a223cab42a9b14

SHA512
e9d6ae679a1ea8367cc2a035fe0bab1d6e8c0a80a162435af366960461645bf9db43cda1901089d77962665d730cbba787169988d44f030acea7c89b4bf95db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2d3fb64fb47ca48201942fcdb2060d8

SHA1
d438c0643cb619a0157e86d9bb9bcf1ca6870902

SHA256
4647509b3cfba0dd6b4a335f161a552763667e18fd20f42c5dea6b018eacae75

SHA512
109bbfd44eadeb4949905e1b1b57de0ce7313a22ffe50b973d24a6bcb359a045c8be32f4942ffeac670900a169c9412da9301e079d20f1a93452908559ae6f3a

Download Submit