hxxps://clownfishtv[.]com/

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://clownfishtv.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3652	msedge.exe
3652	msedge.exe
1896	identity_helper.exe
1896	identity_helper.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4484	3652	msedge.exe	83
PID 3652 wrote to memory of 4484	3652	msedge.exe	83
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 4948	3652	msedge.exe	84
PID 3652 wrote to memory of 3180	3652	msedge.exe	85
PID 3652 wrote to memory of 3180	3652	msedge.exe	85
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86
PID 3652 wrote to memory of 3216	3652	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clownfishtv.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff862a146f8,0x7ff862a14708,0x7ff862a14718
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13762254156466491467,17176451300777814707,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
249KB

MD5
d3e111ab410e787c5309b45befbe81ba

SHA1
51f453dc34ad2027d2d8a2b6f28fdc7ce4817fcf

SHA256
664d537e9fcbee86d0c9ea1707561cb1f9283f9654fcc51e4bab041a379613b9

SHA512
39ebc1070c016eb7133955942296f75e60488708995ea1ac01d97cefe3b6add804555b049b60e7157ba880972f4ec234c1ae4db00102224bc32d4bc56cdd993f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
73bd6b914208a2edfc20cb73f7155000

SHA1
143d0291017678a2faab1dd9a2759c1f753f3b52

SHA256
1c60e37aa36b06e1430a91746ebabbf001d9729f41fce6dc0b237213324ccf30

SHA512
50d706fb2c679a67874a914ad779584dc8cc10f6c0ae421f33364fc3d8b7102cd1d1df76b5d1aa80bb941bf1d56afc69085ebe8e00c97c2c95e0bb54aef0069a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
eec9cc04a598a4c87bc15831553dc2fb

SHA1
bf1100ad8164e9a9cef4ea34f6d5c641abada159

SHA256
2b5622fe900fe22406157fe2f95fb4c670b5a24952eeff851d092a1f433dd33c

SHA512
22b45f44c7c19eed0e6204f8ecb004500d9e51439c3fc876ba0c6da74ca68f591cbb85fdaa4037cdbc9144555db094728f613522d55ce4c65ac968272b6e3048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b555cd99d3abc84777aafe5c67bccef8

SHA1
f3f6522f1528b348e32ab705b750137cea0085ed

SHA256
892ccbecd8b0246bd211ccef8c0591fb03edb3a68b32bffa3eb53d5f6ec7cfda

SHA512
712651b10c73b5cd86ff6c77902fca236d3d74cf614729f579469a0c96ebafdb7c0a2398ee46c19e11fa3366f2190909671c2af5af4de07b885ec17c4e80c5d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
27ef6a95138537c0893c6f93fa652338

SHA1
b5704131d9aaac6ce76994a53230b0df581c41e6

SHA256
0c676eb0df1f6fd87cf632c6cb2955617583f01e912d7fb7d1f6248bf6f38559

SHA512
8a751bc3274ed29360833bf665044cd4c0c9034260a181321f7fac84dff6a55056dee98934e5629f59aa28b4928bd2d29f2b4c6ac3c48c1162c84cf15ab2196a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf09b55dcd77f9ef7d4fa0b38abe50c9

SHA1
b126e54e0db16fd429ba7fb9b8e9e8549497ea95

SHA256
484df77f890693b511fa238319ed6e80ab3c8dc82e8bb227d025eb941e080248

SHA512
29362493f0abc023fb4d1aef54842276fe68559231889468359165f017e9d34622aaf95bb9075101b4ac853f7ec01d62c2bbb66ef15a8b1039442235be6c1eea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49b7fcf8d62d33e9ce6facf4f748346a

SHA1
a45d4b8a931e09fb76e8c7d15ae091d27f37cf33

SHA256
8be71131f8184758d3d3c05820e2334d38100dbf8a1cc72d0aebf107f7cc22db

SHA512
adc0157a18b36c5a26af6581ba3a8df60c10c6adf71d53089697c93a1665c194352479bb626dc9f64e5252196db6b2d6b14b62a4076947114b1384c3d9274ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66dd1c4b4b1712656b70813dd78cf9b1

SHA1
a2f21ba9a590dceae52d409a39e66084694b9cc8

SHA256
a2a73444f220efb0f16b6c3b4fdf02c787c5cf1f9ab02dce77548dc9d873122a

SHA512
5ca9558d77d13bf083d1dae33ac39e57f625e3a29281626ea68d2a08cb81a0730faa616928964292cdd7b61ff9db6ab543beb54b8d66b0b88171e8434022e01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0ab1c2eb6667ba6668e162668a97a3b7

SHA1
2d21e1b3f725a0e7965f1a237286bc0c16692fa4

SHA256
f87e11a7bcf63d4a4194138faaa6691ae172587cb83bd9ad9ee678f0be384697

SHA512
0c9e090e791142410f74d18b7f3d754ea59300e87c7efc1a41f124ba80de37be7cfa1dd6712042bf15c54f8c27d7b35ab200bfa6283b9ef3964bb8d4d8118e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
73d0f52618b465abbcd0dcddaa6f0073

SHA1
4a98e6da56404aa07b7166314e8bd24edcb70253

SHA256
0a4cf728f65fdda65bd0723cb6fda02361fc9f194a1086e18c8b9661c9ba6317

SHA512
14d48d3f5240708e1764c911f716bbbadd8f546f2118b0d699fc2b9e247fe821c374f93ecbd597e9f6fbfc70dccf15c0f3ee1934799adcd2f2ff956676ec0e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580191.TMP

Filesize
869B

MD5
5270feb00b40d55942edf70cbda3129d

SHA1
a0b99eca861ebb0df2775aef72cb059f03595183

SHA256
d12e9bde581b929ce974abc1194bd014e79be5fc42a789ee8cf682f767536277

SHA512
b9325076b48c59c398992998577af8234d1aee10aad2a5818d28dae51d7898fc3becf750f49561a6c69fbd8eecd5b454238ad5549652d593854f32ebd81797cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
affde059322c669d260dca6699ad430f

SHA1
dfb56c13d740eac3d5941df94210742e9115f200

SHA256
56a5883a3a13ba4ac5fdcd9f693363855c1793cae7ba0a820b38b0b9ac26662e

SHA512
bab9e2c4b10275f67360a463e8c7ec954d39edbde8284bae4ddb9d641ebb0b8ad54fb04e7921c5e12b29dfba1d7c586329d7ba224697589d58506e2e194d733f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7df41d3fd94986d739991328b639e4f5

SHA1
b88f381d8bc59318768ed50584d0076d116142b2

SHA256
640dc25463874cfc53504f98fb486631fe3fcaa7c44311f41d5c631b27d9dbe8

SHA512
f53165953025ae7987cb216a3591a6ee945b3d2f8254dcecd8171103cfec27bf0c6d255fcf87c400248f1d2e41d40a99b4c98b5e603a4832db0a2f4e13e6f958

Download Submit