hxxp://tersale[.]com/?fbclid=IwAR2hUI3MPAt2oLfSM-po1UfbKqvIXLhvAN65rfgzntMAn6j6x2_k8M6Wbdw

Resubmissions

12/01/2024, 18:19

240112-wyg6padge5 1

12/01/2024, 18:08

240112-wq337adaej 1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tersale.com/?fbclid=IwAR2hUI3MPAt2oLfSM-po1UfbKqvIXLhvAN65rfgzntMAn6j6x2_k8M6Wbdw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
4736	msedge.exe
4736	msedge.exe
5556	identity_helper.exe
5556	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1476	4736	msedge.exe	27
PID 4736 wrote to memory of 1476	4736	msedge.exe	27
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 2972	4736	msedge.exe	90
PID 4736 wrote to memory of 3968	4736	msedge.exe	89
PID 4736 wrote to memory of 3968	4736	msedge.exe	89
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91
PID 4736 wrote to memory of 5008	4736	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tersale.com/?fbclid=IwAR2hUI3MPAt2oLfSM-po1UfbKqvIXLhvAN65rfgzntMAn6j6x2_k8M6Wbdw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc0746f8,0x7ff9dc074708,0x7ff9dc074718
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14598889662943351242,11244302178496570249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
55KB

MD5
7eb56e74565e07c132457fb673e6e71e

SHA1
a6ae36778f7b70116575a3311bcac5902a2daa20

SHA256
68ae58153501399f3c970ce005e5edd5bd785e767362f1f0c4d6ae2a6e524d8b

SHA512
4caccf6f8db7471d64191f9587d3bc47fd01d8e1ab03b57ca0a1071c4dfb5e28d1852585e3422bde46bff05dba04e2c9f32fe95b2ccabf323e2af7d3bc9ace8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
35KB

MD5
66f0bf20f953c37683f9e8e8ff52b74b

SHA1
4f3167c9d6ff6f8f9609928604d97fe67764660a

SHA256
1a9a7008a3468228e981f8878ed1e0abd114bae235096e14ef2cd49fee6d8361

SHA512
bb7ab53acfe95e5804705b9cf4035aeebaa67dc811e2e834a664bf8143bb5b3cec214fc43462286c7783bfa1354bf08e0194c68675d137d995058f44f1bac5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
36KB

MD5
5f5e7007cefc4ceb58e7980620220f53

SHA1
6270e1992e82f090ff7a12bda9f22258e3b960d4

SHA256
5c7dedfc8512745e3f058ababf4465ac4b86086b95d99e4b64de60704dc4ce2b

SHA512
e7edccb273851f16efee6423eb9ee0940c94d8fbc10356ea478e08a302bd86a805a1fcfd7dc816f4c30c5e1165894bcecc130b5de76b0855d5aa182adc38251c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
34KB

MD5
a9e7c3937f445b1636316002e63d8924

SHA1
697167f61d0fbe06b35e8f777efe6877b4037427

SHA256
6b8aca8fe6b72eb08ad2ac4d69974ce8999fbae0355b3c50f7153295bce49dbb

SHA512
cb78d79794b2c27e73f7d73727bf31e6d51eb41a01c93bd2c27e9bab05ed9c99cee8bd0bf4b9eff511dddd21fdd2bc0f69d2ab291648abfefbf842bb320c607d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
34KB

MD5
c32018e7aa3a148236f3a5c97d0dfcda

SHA1
b4f940c1e156e6193368ecc9dbf4fe96665b4204

SHA256
2d84463de8db9786fca521ae6d956b372f0ff7b77bf5677fd580400265207876

SHA512
8c2f2a3fe73fc783f8ab112939991f7f5e323e6d6024e0e604f8d8af012071149b4dbca3be18c4b3ffe66b3bc915f08ba3d45c20a16c82640fb2dfccb27774bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e23838e7c7c76ded199cd799fdc65748

SHA1
ad292256f973bd73347126311115ab08f7b76e81

SHA256
5d3d5e2c60e0a50133af75d468288b62c7e2fdf5373e42ca87482c30bdd5485d

SHA512
6bfe94b16eeb68eb530617197b504d43f4cd755058573c11f492bfd890568f4ead945c2e41f647dd563745acf90b29216f5aef0abab73552f32e1fea74486cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6aeaf1edd056bcbf0ff3b2a93ac08321

SHA1
bc864b5fe584369b3c5d8bcd9ae3a98a31cdf0ba

SHA256
45635db6481588bd963ba3da8302ff8a9cabb0484c2cf69196fe1b44121e3ae2

SHA512
bc6b2f658583f470ab93ed90cc35eba101cd73e964bf7e185cb8726b4cdea386f8cbe7689e229b1b75925e3a151d3daed7b5cac0f63bf17089b623e5aa554bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f2f1fb167ff9b6561a995e65fff612c2

SHA1
2ac93df0eca4517bbb3347f46f2adf0341d4a5af

SHA256
18dd344c922ad4a6287237e568bbe2edef56837ac530e5a72773d829cd6285dc

SHA512
13d47bad41dd250c8a08a981fbd7d87d9a982c360ee72169fa1f3e2c52f8820eeb2d35bf8d86f7bcadf8cf376e243c8de39386742def05d85beb21443e715057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fedfa06689a878f9f429500fa81164d

SHA1
ec05d76749b4139e3ee90ad194ac7da2cbfed67e

SHA256
7a03a53f42b7844b83307414b687d2174ed119cd9370de39642fb1ed6b8d24b5

SHA512
e720416b3cd108bbb0f2fbc7a1d654d9ade650b8241338a301defebca849bc9364bfc82777ed7ca708180aadf268ed978a58ed8c9abd25df8aad5339cdf5d239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed2fc8fff4c4dff92707fa3a158b60cc

SHA1
bf5c707cd5d4a8068060b2579c3f1723e370929a

SHA256
e42c4d76b1c36f66de7b8af81c7c20f211f7d9d547c0ceb4a93941c711b61b27

SHA512
874280ea6839458c1b085cf374f79372bb6b66a8da329ea24563f6499ab8968a71b7c54866637e8ade75ac6fb6d85f3e73d9c7c3b4bc3c84196e020efc31caa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3e3d9aa5170ce0ae66b6057de632fcf

SHA1
464cedfa6790c5be3c3283f866a21bd0fac109b5

SHA256
0c3c1c3d24302bd53610c7fd4bf327470507aff6d84d5a5fcaba9da3e18274a4

SHA512
e92a864ef0bb7b94ea2df4987fedff508d77515eff59df55e0c31ca098b4b2610649c6a2818c95df388f5ede5b5ca97269696cc2e565b92092aa58da96f980fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6593b57a527612e0cde4f26a4bfb911a

SHA1
45a3578aa66f15aa2790bafde1fb643d4496b257

SHA256
4e00c1088e248d6820967a848ee66318359d5a0a972f53fb303473938c23d25d

SHA512
2528e77a300b3f083fba8585788498d8731547adab9d73bce053b30a2844ee1d65f75bb9910eba2d87733e7ac3d64f9d51a523dd894116f521bfe8cd82414ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
35dd464c5f8d5140b55b1035807cf4b8

SHA1
491499dd3020e025c8bbd7f5ac0b3e657276f53a

SHA256
6b501758e6033e4c227fbe2ad46ed80f0aaeff0d28f0371fc6ff8aeb64fd3628

SHA512
6d57603758d4dab90386e7b3f37508f96bad91f255e984d2865af44b699251c6ca525c41c0318510bf4bc5d72634c2070733e761fa64afcf30abc1aaefe03510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b2e5.TMP

Filesize
2KB

MD5
7ce94f948e17f1cfbe67e498871aef67

SHA1
3146bab01a5796e9757db60127f165bc1d991582

SHA256
af1ec4ac4d41de75119ea5eb3a1585a1f3c0de4de05e1fb0b907a50a9681a444

SHA512
bf297e4cffacea86be5d0e72286ebd24083767d773419853170e55266659e43edcd26b08829c4f6b00dbe43f512745608b3b2ea59b677e2c50d794e0f1101644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
23beb6865105b229f8ff2269be042dc2

SHA1
d8a032321003e73deb5cc72b7f031a892f93a9bc

SHA256
21a70f0ae9717270439fb6e9dea0b779c84380db77dd36a9cdc5811214d1b08a

SHA512
754f977364c5fbc10884831cf7a5d76215f3c186b8fbff40b73ed49c70b2bdbdf6c18e6332bcf3fc63966b3c0145bc25eaa80372dc4a2f155f7ba24f13279c4b

Download Submit