hxxps://www[.]bing[.]com/ck/a?!&&p=4c556388d36336b8JmltdHM9MTcwMDYxMTIwMCZpZ3VpZD0xYTZhY2ZmMy0wNGQ2LTY1MGEtM2YwMi1kYzQ2MDU2ODY0YWUmaW5zaWQ9NTE5OQ&ptn=3&ver=2&hsh=3&fclid=1a6acff3-04d6-650a-3f02-dc46056864ae&psq=tor+metrics+relay&u=a1aHR0cHM6Ly9tZXRyaWNzLnRvcnByb2plY3Qub3JnL3JzLmh0bWw&ntb=1

Resubmissions

23/11/2023, 00:37

231123-aysrjaga3y 1

22/11/2023, 23:50

231122-3vve6sfh3x 1

Analysis

max time kernel
131s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.bing.com/ck/a?!&&p=4c556388d36336b8JmltdHM9MTcwMDYxMTIwMCZpZ3VpZD0xYTZhY2ZmMy0wNGQ2LTY1MGEtM2YwMi1kYzQ2MDU2ODY0YWUmaW5zaWQ9NTE5OQ&ptn=3&ver=2&hsh=3&fclid=1a6acff3-04d6-650a-3f02-dc46056864ae&psq=tor+metrics+relay&u=a1aHR0cHM6Ly9tZXRyaWNzLnRvcnByb2plY3Qub3JnL3JzLmh0bWw&ntb=1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
428	msedge.exe
428	msedge.exe
3348	identity_helper.exe
3348	identity_helper.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 2600	428	msedge.exe	85
PID 428 wrote to memory of 2600	428	msedge.exe	85
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 4524	428	msedge.exe	86
PID 428 wrote to memory of 2956	428	msedge.exe	87
PID 428 wrote to memory of 2956	428	msedge.exe	87
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88
PID 428 wrote to memory of 4520	428	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bing.com/ck/a?!&&p=4c556388d36336b8JmltdHM9MTcwMDYxMTIwMCZpZ3VpZD0xYTZhY2ZmMy0wNGQ2LTY1MGEtM2YwMi1kYzQ2MDU2ODY0YWUmaW5zaWQ9NTE5OQ&ptn=3&ver=2&hsh=3&fclid=1a6acff3-04d6-650a-3f02-dc46056864ae&psq=tor+metrics+relay&u=a1aHR0cHM6Ly9tZXRyaWNzLnRvcnByb2plY3Qub3JnL3JzLmh0bWw&ntb=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6e9646f8,0x7ffd6e964708,0x7ffd6e964718
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2576 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1976 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2865088017561953482,3624586438873082459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
8e3b794f7bbffd6aa30f0e90082412f4

SHA1
27b5fc68c98aa92fc0a773d0fe63e06205744087

SHA256
a02ec854fe20919e3b1cd8f44a2c54bf7a43e0b3eebbe4072bb76bea023e1c25

SHA512
bf2ce4ceb8a8bd1d40071c7992be9ccdf022adf2ace9ee4259597eadbf5a9d68cd0322d78957e9905eea4961ab3ca41b8a8f232017d6044a9443316fba8b484c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbabdd83a3c769863f6c14d53c7f5a98

SHA1
f38f8c9912ccc660625036a0e2d6c83c3b49de9c

SHA256
1a79d5af33057ce6d2e52b7c106bee160c75ebc37486fb26d4752200b106ef47

SHA512
59d6b3bb6caf3708ca8d163e0acf7fda20f83ef07ce8d4f435c534b60d79f6da0f445734d1f3258bcf90da7ec24a628fbfe0532a3e7a5c25efd1740b98dfaa41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22678a3e04bc8a5632869c79e1a995d6

SHA1
1321c85b54df6d0a1c5b30dca1f07c43d6eab6d8

SHA256
ad86f454a6da38fb2cd7b547abf08a2ed71a8310c267b49593bb834405331498

SHA512
45786267a6d6669ee85d10ea832b711586f223f3100b745fc504504957c5f7ae82cf92013b76054b4fdf6671b2c629bbf44e23530a367d0c2276765d4fd31669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
f56172c687562c1ff5ce23b59fdbda49

SHA1
0a407473ee42bbf6e1fe9e51d9fb2eab0c864b57

SHA256
4d8429b9e1da1726094864e849b8dbf28c0002a39cb00b164cc938d1ed1c46dd

SHA512
501c167120c7fbc73a5bad0d333cdb5b2913c989e78ca6b913c19fec957731ceac432983714f2dd0611de5f9af5ad6065755bef1ba5b104aa08aeb91a0f4ff80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58409e.TMP

Filesize
204B

MD5
c7b80fbf2bf6f25c19f266502eb510b5

SHA1
229521032fafe8a53aba1d8b9c46b899c331ae53

SHA256
9bc370483d61fd5cfabaac77ed2cb4476972c60f7b0fe588453e9a1c5e1dd210

SHA512
54e373c7c1fb6e5caa4b28eb4a575b3b8bbea4dd1bad2d5ec46bc9fed52469809a35bd77404dee0c1d5751b42ec1faef3f2d7c1b94fdb7a909b7237dedbb1ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c56e0c5b-a23e-4df3-991c-4bfee8fba9a5.tmp

Filesize
5KB

MD5
bf34b27dc3b0fd631ca35b77c51959ba

SHA1
cb2ff85349401fccd15a58a63860d6a900267d5c

SHA256
5e7b47577e8eead5ee07d81327c3a2da57df553ae39976bff6f6514037d82499

SHA512
923c1a36193e75a364e603b1483a4f7767ee254d93161257437b8763b4813dbf642ff065b79be026a2ea29dea298899379787f8b1eb80161f5980d48f18c08d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4465c7dca7c751db8e8172ba72457c88

SHA1
f278d50a0e25e4e368e6f77efc8323f070d0a55d

SHA256
03022d8aff3752a6c9ac53bd5b749b33967e38860f8c6b14fe942a3908decff3

SHA512
98cb03150e1655fe85613b47cea31eb441b99f4a65b278a55905f652f06769bbc196ffcd26c1f1cf4f0739f3e7e969594d7bf73d04e0f75ed6aed8f5129cfd09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a951b928ada71baef7529a36552bdea2

SHA1
fbfdd319ea33c41251019fe2688570774fd8a8d6

SHA256
65573063673aaece7640cf423a176bd89cc2fa3aaf703f9f5ec6cb084ab4df46

SHA512
6d204fc2144a94458be39fc1cdcbce46a982cbef3329ef16ca8437b401a8cdfa56848619bbe79f15fa9aac2e849953add5cb71a65292f0d0de50b62a13dae014

Download Submit