hxxps://app[.]longshot[.]ai/share-blog/26d47c6e-6955-4037-8f9b-fc43e58aa484

Analysis

max time kernel
142s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://app.longshot.ai/share-blog/26d47c6e-6955-4037-8f9b-fc43e58aa484

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3803511929-1339359695-2191195476-1000\{DE7E3E5B-6E45-49B7-8419-1C793F7AC9B3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
4008	msedge.exe
4008	msedge.exe
2188	msedge.exe
2188	msedge.exe
5624	identity_helper.exe
5624	identity_helper.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2576	4008	msedge.exe	59
PID 4008 wrote to memory of 2576	4008	msedge.exe	59
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 3604	4008	msedge.exe	89
PID 4008 wrote to memory of 5056	4008	msedge.exe	91
PID 4008 wrote to memory of 5056	4008	msedge.exe	91
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90
PID 4008 wrote to memory of 1704	4008	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://app.longshot.ai/share-blog/26d47c6e-6955-4037-8f9b-fc43e58aa484
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb0ae46f8,0x7ffcb0ae4708,0x7ffcb0ae4718
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1702131033779807791,6989279174900750533,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
e6858f7ed92312fd80b5b057d6ca5c7b

SHA1
b919fb8f83ff2de275d71502d86ea348757a061f

SHA256
92b310221962a6b5c1c154ef51a04802e441f3bfbcd533c33e9931b56098bacd

SHA512
dfb96b638b6ea20902e3c774031fc024f658048b3a45756b50da85db983bc0833042fa5a639ef46daa88ea0c873703e439f836f9dffa5e3955d2c2d71acd1680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
06555c47f0d50487487836ca3368f0e3

SHA1
8867c7f50021dc07360cc22b30174115c020b8af

SHA256
1497627e8628ddcfd5224ecf0a0b22f3ec75647518849d410eff3c158f6378e3

SHA512
c5168d294b79a2c4865603e098c15fd51a11f35e5daf57b98c486573284d680bf7fe3d8b3d87bdc74b2c9189905d5a5278c6e99f18896c1a90637a1e87c3cb5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e2b97d1c8ea747fa2e311ada777cc63

SHA1
b975fac4c93f0e375070170a401001b75edbf945

SHA256
f0e51a16454fd9f90d5f6346a7ba0d6804344e67f187004b8ca0e7f42f6e91fa

SHA512
0bded533fc3d808973a45b0e1dc4450b755bc1f55e8d5d00a1700354950efc9d2a1bb8536d1b27f6a911c59378f1b70b1940a722eae6a9cf8ef18b3d405d41df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a867634e88607a1980d5f1e377446da2

SHA1
85b2a3c0eb66c33f2b6abdee75e11ce75995382a

SHA256
236e9b129d81908e3f49c529278a4147122ac2592244fa126a8b065b11022736

SHA512
26fe8d24513c1e438412cdd9685ca05f98d6f93f5f99352a27cd51deb3cb93951ef9fedec0c0f272d11e045f746f334a2ca74fee20af55e53e916b6e6600e65a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ef9233dbd874eaaa0f002fda77b0f68e

SHA1
9217b7a7bb8f64e81f24b1ea98df68a61f48337a

SHA256
19a15134d0440c6216c63aa58455d5f34c5988c3878a50c38f704cbca7ad53b7

SHA512
e23d2cbce3f09cbdc551288ca071008c9d54034358d23c91132c0c3ebf760fb65c67bbf418753c34e60fef9a93c6625d72898fcf61c233dba9ee8c989c2f81d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b882.TMP

Filesize
2KB

MD5
48cc51f7b6fff395e51297b95020a4f8

SHA1
364b0f9951550b6f6f2ed8278d23242b155b05f2

SHA256
cd303905ad2319baf57bf254be0eb2b28a723b5e4f31eca2b6fa7ca6365831f3

SHA512
4b6632a5604a574320d2f04de5ffcb4c76b5704f67ab3e4a26f299588c0405f1bb996b95131ef5fc23fa195857ff7b86a8284f9eeaecec02e521b147f6fa8f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0fc2092a31693d7e1a23560199b6b70d

SHA1
a4a97a7d3416cf7ab5172b6e62d678b7e2aadf42

SHA256
f7d657b6d29f4fb75037d33c79221e5f9444acf63b9d38d440b2292f86acf752

SHA512
f647633458485571367eefc58d330d6860a18672de7fb8757a04d5d87bd9e4d9f5791460cc67438d2de0fcbb2286bddf8b8c842ccb53882cd1534615f7080eab

Download Submit