hxxp://api[.]bbh5sdffi01[.]com

Analysis

max time kernel
158s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://api.bbh5sdffi01.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
3500	msedge.exe
3500	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 736	3500	msedge.exe	29
PID 3500 wrote to memory of 736	3500	msedge.exe	29
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 1948	3500	msedge.exe	87
PID 3500 wrote to memory of 4916	3500	msedge.exe	86
PID 3500 wrote to memory of 4916	3500	msedge.exe	86
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88
PID 3500 wrote to memory of 4768	3500	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://api.bbh5sdffi01.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3d8946f8,0x7ffa3d894708,0x7ffa3d894718
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,12868300359252324923,12235664110753592628,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x30c 0x410
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0f41ff8ac62df22bbe4aab0bdb6391fd

SHA1
2299def9d42a543204ba322fb63edaabdbec96a9

SHA256
5e3db8c6f2cd00a7bec542ae9fede85b578896dcbc67197c34275ac9198576fb

SHA512
1efe0e1cf5a4339b7ebf9aab8264db1d4e7a5aef44441a2329824102873daa1710dcb77a91431a3a26cfe0e994017c9608e3c0078b7871edb8915d6ec79b7080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
88ae5ce23f2a9eaba1760da36118847d

SHA1
f960f1078a746e42bcd3d4f01048327c637b90fb

SHA256
4a058d231c69ff42913532ced8854a119e0ca1e00304196b880bbec13d513705

SHA512
4bd1133c7288f48ed37047dab738ed3b185d20e89dc7732dcd2bfc12d53ccfcbca22c120b54dd5a31adf0a81ca4e1d1b5e8ad1897b65b507b70b60f2b1e2aeeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
21eeb529a8d5f325a9206165b41ad185

SHA1
ad5f110ec6894f411ea29cd81b1c28f7c858e694

SHA256
33c794b7d78c311e98084e2c60c62827f8df98f15f3643dcfa7e4448b2782fb6

SHA512
a23efa051d8e15ee7047d98912898756ed61b3b2cabed39c3b4a7fea9ac86b650588f7434efeb58a871b44bc86e5e5966f1c92ded0d0481f3ab95ff09c529839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca721381a8dc8f1cc1019f63289757d7

SHA1
9962ac2917d15ccd46ff4a2cff1563d0309ebb3b

SHA256
afe5d35531b4029ba9949ad5993de49826f3dabee8556454d9d225019f3b4f99

SHA512
5bbf7c9e2666399786956b2379e2fedf23176ac2feae25f56959413b83162704c16d5bf7916f173b199eee1ab5b8e3b2467334f97db945f02a38ae60de346663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3ffdab6a5ffe5f81a90bacf84223998

SHA1
5549dd40cce6a1fe5acac501c364e3b8bab1d092

SHA256
e1b4784a26ea0e422c5dd75ac27b0d70dddb9f98c6c13bdc5a91c1d5606b185d

SHA512
4bb9d67a4969de95b18e31e70187d5610066ea06386b8ebbe74097444feec1fef05f07eef16f39e0aa349f0d0d9cbca7eaaf0691ac5ca82ebaffcf6df903b310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d52fc8ffddd3d071dc71e37162ba682c

SHA1
f0bab5e5f51cdf43f96f407bc454ee253eea206c

SHA256
f50cc6c58ca4a838ab51ea4681ae79b59032077bbcbbbcfdf9a2b686c6477ceb

SHA512
e57efe347c8b42bb51c699cb916aee7afc5d13cac1ff6ee171f168b79709c2b27ba3654d81bf20b342f9e802c048581e510b81493524101addb87c5e99b97b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
687e89bf2d1ae5cd1f277e3a1e08b47f

SHA1
e6eb263d36787dae0eace945b7dc4777d1f6b63a

SHA256
b0abd2bff3803a052ce05701f7bb83736995299d35d7200aa451ffea2604ab74

SHA512
4a62010b50ca3236c6ef61e08d006650bc7d3f6f88a4479c608f73672026dbd4b54211daebe635624dee08e2433562a63fd09f178eec9471d4b0896b1542bdd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
593c8ab05dee50cf76f90b116149ddb1

SHA1
ffe28f3bc54e98904e72cee9675a74ffcbdb2e7a

SHA256
26c575cc5fa346c63bdd8be01c1319d3ddbeee376899d84ac473d85e6458d3fd

SHA512
26ebadf3eec6c84b0d171ea5b0b3580a32688b80c7cf9aab507ae23a837f02d45ab2e791a105500d9a461542121716c51b1fcc263316a09d7ca2c3c396966a24

Download Submit