hxxp://34[.]151[.]217[.]124/

Analysis

max time kernel
36s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://34.151.217.124/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
676	identity_helper.exe
676	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4388	4832	msedge.exe	39
PID 4832 wrote to memory of 4388	4832	msedge.exe	39
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 4896	4832	msedge.exe	85
PID 4832 wrote to memory of 3748	4832	msedge.exe	86
PID 4832 wrote to memory of 3748	4832	msedge.exe	86
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87
PID 4832 wrote to memory of 3956	4832	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://34.151.217.124/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd91d946f8,0x7ffd91d94708,0x7ffd91d94718
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11898300657166746870,3176433921558971403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
85KB

MD5
45a177b92bc3dac4f6955a68b5b21745

SHA1
eac969dc4f81a857fdd380b3e9c0963d8d5b87d1

SHA256
2db3b6356f027b2185f1ca4bc6b53e64e428201e70e94d1977f8aab9b24afaeb

SHA512
f6a599340db91e2a4f48babd5f5939f87b907a66a82609347f53381e8712069c3002596156de79650511c644a287cbd8c607be0f877a918ae1392456d76b90ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
125KB

MD5
9d5353c4258cd32c54b67a3410e9ef65

SHA1
7e51e302615d347bb82dccd54d55c2488bc66f1c

SHA256
201b52d3770ae2607ebd68c158230143e5a9b80d03a71987f975adc90591fea9

SHA512
2c705e8247a3c935baaae46f9b4e0d611e26075d735ec86f505a77731d4ce5b77736d11749d3619100b2786b334d09694bfccf5c535cb1a6c3dab9f306da3eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9427ccd6bd46391f8a93af07ef37b3de

SHA1
98069adb7df2376aa91be5757db00dc57533d9e0

SHA256
d095ab2975bb1bb4070d0337ca1e99c94c3befc9ad4e67e6ddfa6f675d202770

SHA512
4a54bf605742f7f93260e778896ac3769b869ad104ea0e964dee517da46fe83332d3cd351498607175af6553f75d149467463c87db137ba4ee28f29d1888af21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
834042ce3ae059dddcdb9356c27865c8

SHA1
9c27942241602e024c0869690c96905c543afa67

SHA256
e3e1e12edbceb4194d8594bb0e1cdc13cdde36f883cf718882e441b49ad5d937

SHA512
e020827c7052bff94a78ccbafc02322d2576532129602bdb62f69a4ef57f8cf9507bc7f139cf93181883eb97d6bccd655225d8030a0f98d393b7576e7677250e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd82c209b6270e0cf070864c2da42db0

SHA1
86837018fa4922e98dadbd650f471ac86b2e91fc

SHA256
a1daeb403a45a46a8f95b34eca6288b778481ba990585c28abcf41aad5139531

SHA512
9a56ba8e80d79444baf7855452302e097abd72f8be65b204d0edb5b16973177ef503051d91114d6054bd0392aed3f125269ce6ae69cca0ede6e81b6d359a7a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a8c7ffcefb9f3b0358b42ca498d5733c

SHA1
c58c9c1e290f5dea903d663246ab4629da91ed0a

SHA256
1516123544b8dc8e33a9dac53191d2081d25cdb8f3008f8f04be1af31b540ef5

SHA512
081f444e20057f1413201acc16a6694a46b7e27d9b2d7b6076ccced05d9e3b95c445b8d2db808552e8c5459601784be3576bf4253bb25389a06d1f4233129e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
bc90b094551fd5b350f12bc099527aa7

SHA1
047a2a26c46134556fd8697d2e0ecbbdfc105df8

SHA256
a6d82ff8505a032b72863fb29cddbef3b9d64ba0c4e24cfb58ca9a628399c733

SHA512
a40ecaaa93832d8ffee48ee8612c0f68196ff231531c3423f1f0a2ee5343d6eade4c98024c77963c4fc883e5bb7fc5ef3e898fcb25a663c1f5676aedb357dd47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dc56.TMP

Filesize
705B

MD5
850c8f288269d0e5e9349cb0c27e4c87

SHA1
49e289f7f139f57ded95c3c16d614014c66f1570

SHA256
e34869d279143ffd440e04d874905a23ac6bc63565c71b497f221f73d4210a78

SHA512
30025b34827df8b9ed1b0d8825bfed433c35161cf426be8ec245c4746abc0ab0e73b00a39034f7512b1db4f531c27584effa3b19881326f686e20e88877d9794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b7692c909128c69960e1b5d9e1e8b62

SHA1
7d6c4584261e4cc1569e24720193f05398d650a0

SHA256
aa2458209f789e20b708e89b2f3ccc4a1d9090fa1bb633dcfa63b7d9954a7cb6

SHA512
66cb7da986f310c9b0ddf7521284cfa3cafcb79d962d120add4d79c44c25e31b71a58a4fb71ff41723af2d7e8714ff26e9701509b143faae9721616975af68db

Download Submit