hxxp://url2209[.]abatix[.]com/ls/click?upn=07glkT5gBGz-2BPq0p05rJOIJGwXemjVjlExg-2Bk4F5wXgyIHaz4uVf-2F9hEftgYecZACPcD_FMdrpyx2GwWIuNQccqlJewwJjsBprA-2FfczWOX-2Fs9Lnw-2B-2Ftkh7C7lbwSIff-2BJ6tfSuH0YuTo4WmlxTZMlPckO-2F1RL2ilyGj5OcKgkpohSuq19vNqkJxA83iE-2F27r47dptN7fbUelxawF-2FZ-2FJn5WudXMkoDPAQ15exC3U2nyXkUt-2F16GKb4z7Nt5oo818DkrYSOWIBL0Fe0yC9SHV6gKh2S7OngSujwrU2ymDkA-2B5SZ-2BM-3D

Analysis

max time kernel
54s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
01/02/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://url2209.abatix.com/ls/click?upn=07glkT5gBGz-2BPq0p05rJOIJGwXemjVjlExg-2Bk4F5wXgyIHaz4uVf-2F9hEftgYecZACPcD_FMdrpyx2GwWIuNQccqlJewwJjsBprA-2FfczWOX-2Fs9Lnw-2B-2Ftkh7C7lbwSIff-2BJ6tfSuH0YuTo4WmlxTZMlPckO-2F1RL2ilyGj5OcKgkpohSuq19vNqkJxA83iE-2F27r47dptN7fbUelxawF-2FZ-2FJn5WudXMkoDPAQ15exC3U2nyXkUt-2F16GKb4z7Nt5oo818DkrYSOWIBL0Fe0yC9SHV6gKh2S7OngSujwrU2ymDkA-2B5SZ-2BM-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
3964	msedge.exe
3964	msedge.exe
2616	identity_helper.exe
2616	identity_helper.exe
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 132	3964	msedge.exe	28
PID 3964 wrote to memory of 132	3964	msedge.exe	28
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 5088	3964	msedge.exe	80
PID 3964 wrote to memory of 1516	3964	msedge.exe	81
PID 3964 wrote to memory of 1516	3964	msedge.exe	81
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82
PID 3964 wrote to memory of 2804	3964	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url2209.abatix.com/ls/click?upn=07glkT5gBGz-2BPq0p05rJOIJGwXemjVjlExg-2Bk4F5wXgyIHaz4uVf-2F9hEftgYecZACPcD_FMdrpyx2GwWIuNQccqlJewwJjsBprA-2FfczWOX-2Fs9Lnw-2B-2Ftkh7C7lbwSIff-2BJ6tfSuH0YuTo4WmlxTZMlPckO-2F1RL2ilyGj5OcKgkpohSuq19vNqkJxA83iE-2F27r47dptN7fbUelxawF-2FZ-2FJn5WudXMkoDPAQ15exC3U2nyXkUt-2F16GKb4z7Nt5oo818DkrYSOWIBL0Fe0yC9SHV6gKh2S7OngSujwrU2ymDkA-2B5SZ-2BM-3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd4f933cb8,0x7ffd4f933cc8,0x7ffd4f933cd8
  2⤵
  PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3237625987476811374,606263951374875459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
552758a7bb19b27354a76866861c4801

SHA1
93a74b56e5bb5aa86a53db413081b3ca7ffb808b

SHA256
53e1302ff50d199fd0002ddb9d4f66fd264b17e73a50e67299adf1243663530c

SHA512
13889bc4ffe240d8a7cf71ca0f2a397f33e38106116f38b5b8fa6c977187899d2d7084d606288f2892d14776460c2fe450adbeb93d2d200caffefe9919076fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
148KB

MD5
6be9d67f4bb98f7c030a28a9783838f3

SHA1
cd34977b903bf0714f968edac693631b54248590

SHA256
3dd4ab6b4da5ae6dd83543886e5eefdcc8805429cc74d82d43311e7dbc96ad03

SHA512
43d85ac8627ad9ea7caa6d4278f0acc1f74243b37a7798db1f2fb889e95c80c278cb6afa311ba362a10c4c37f55a39c1b57d733e384c1ad9d3bc5c4b783a8096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
70KB

MD5
a3f089cf99298b67d7117456b6c52a18

SHA1
41d316f3ff1fe4f74d02924b453048a093d0efe2

SHA256
6855c2c186b1a1f10ccac167aa9132560e723fd986da4a74d8d503b70c41cbf2

SHA512
0e0101c08aa92f05fcd78e5e0f72b60cd943d803dd11f2e6a2a4beb8afc0cfd33cb6d63b33f7b4b52f1a042c372d1dda81cce4571718fc3005a0d5ec5637b0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
96KB

MD5
d65538d137f82fd53f896e2c92ac9101

SHA1
fbbd7db7f221267cc71d3a871ead4f907e0045e1

SHA256
8f02989f08f919b929c72a9ddec9e97dff88931641174e18b67f883b07ab0105

SHA512
7f2babbb4f04610d83b094a495894ff41c9f0661b19070e74fd4e4d0c09e3917429c99d43790a35133bb2c6bbc0611b42948e7e11396fba640231811c75cc958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
40KB

MD5
6fba78fcfc89a1ffe2cb9d5c8c264fcf

SHA1
47ed3afa41d4c6e2682b2f12d650bcd8b04d6622

SHA256
a87c07a155705a8af970e1e0fc0adf457ec375e635cedb81e2c3ae2da77eeeff

SHA512
a4686e27466c40769a27c63f87fdd69ace5d4d6f457c8e337951f94d07d4733d51d24338fce95e5ff77b5973421bd542d94ee6142088d373602a964fa3222e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
55KB

MD5
094a7a861c148240bd23fedfe32d6f7d

SHA1
66559b4f35f9411171868a0a11bcf1e79bd2845c

SHA256
ad333737895fe0c45fd6995f47761a1f6bff5520b908114474ff4e37fe403488

SHA512
ccacf6cd5b89f8e3628013090cb1b97d20dde43082e7769a7da628b5406a3b318d49a301ea460b7e72aa52e7fb78fa0311f8bea08d70d0b1f88c3a508dbf9ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
29KB

MD5
3b062a92364d1d69fa80e062f5a13cb1

SHA1
d42dc97fcddd432343efc77e46891aa944d4d5aa

SHA256
a48d9f071704268d9d42d383025bcddd8bc9daae5df98bc44819a5dc0c00ea6e

SHA512
457336d8fe678234bf089823c69ff17e4254f255cf13d5d6a09a65d9349f575a9d94a2af4baa4c072814e51c090f3c97792ed0bb663535210917d39ac2431b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
132KB

MD5
c62d59e75891ec44b42510c22eb48504

SHA1
4aebce1237bbe253117dd0c89e707d6ba5c8d766

SHA256
17f0677c1eceb823d0e8c8d9c106fcd7d4da3d1be8a92a9376cbd9660d37e206

SHA512
bc371b933ac5aa8d6e795a4299beccd9dfe478d8f12394da81dba22c84ede28335a42386a16687b8e625fdcd499c3898a4a1876aa78945a358e335fd01588bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
17KB

MD5
7f6016d14d8ecb9f702114c546b4ae70

SHA1
a3dc1171b28e199bc302e4f209b6ec96391bbf3c

SHA256
4c954db3e44936560b07895443ae328a239090b4c293888b25131eb718b104e9

SHA512
417822cc1b13e96c9a72438bf79a62aadafd975b6d99f8076ecfe3b86d03a02aebbdf92af4e1f11dc89eb0672513e5bbd18f470c8adad391f4c986ffe2b973cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
6ddd1e566edc119d5bcf2d817e8ae2cc

SHA1
e5d1f957d1b7a837b172b581f333c19c68e09ea5

SHA256
58901ebd3b07397ce404206905a0aed8cbcda35f75a187d773302ce50eadc0ac

SHA512
d4c2e794e1045a58ea655b4270a63954997fa3dd3f0d266a61a7b93debd3882dcba6f54dfe78eaa10bcb57017a973ae6ef727a1f304583f282863cc09dc257ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1b3ca75af9f236efe5592551d66c324

SHA1
bb6d04783da5921c5e4f91e573d8713c9c609196

SHA256
867ad347871534eba13a90a450fc0c5e75b5928d22f39df29fd4acf3e3681591

SHA512
f6146be7cf59ea7dbaa4c6d5883504247241b306201e7c87aec91fd9c7b99d809430ca06f09f4907efe00193ca6791576a83873e2bfd14c6ae57b810f7faa490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbb34fd540fbcb1766fca591b98b7f56

SHA1
9d090020a1dd96fa79f69f2a5329cbee4cf64d3b

SHA256
1e9f3caf75f9f403a99646e3192023d5849c2dc1ee8475fbea114bf73af57762

SHA512
cf3d60448e2806c383a73450cd4371dfcfcd7e77eaacd66088cba7f66907d4d95284da3209daf2305101205926b20a9edac911c471d0a08465de2de329cd5236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a168232696dbd562c43035046a4cb85

SHA1
07aeb2d75f9790dbef2b4614eb17042c71d32c45

SHA256
2f93e2a6d9a3158379ee399e60d5f1a2583e7e644b33b404edef43468d2e8500

SHA512
da4cc0762e6a4e4feffb9f7e856761d1fbbe9e7dc2bc4681b08ee8de53d524c86ad0ac5f0a7286b3492ea7e92a720601e1f0274fe5b28202dee9688945ef0e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
63b6255b3f07d9e42bedebea98f2aca2

SHA1
40ebdc3a328e822aec42b2373d092dc73101342f

SHA256
51efbb488012f6ba9fd2182e4f57da8fe07e915e6b2c000fe96617c1d25d349a

SHA512
0e54c65fd7616217d813904524e84af94d966c93b9097053d0253f0e7111883f47aea07016b9d1096c6e6f877fe2c5754c035e82c6a5246418303da8662bf652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
d8b18185db6c11c904139da588678b0b

SHA1
9be5d5dd10e59a2a520d16b3fdfb4f436362cc3e

SHA256
9988216ff01e9af8113603cab9a9674424c7625f86d60c2796fa3076388929ea

SHA512
7f86f48ea2242c66c37ef8696a33c568f570c04e95b57a84d94a1b4ffa4bb7d8fc562ff7b9b89cdc2dadc7fcda50d6d7b4a0d9b50609487fda5cdabd8ee7fc27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2d6c07c7589022be8c9842bc1237875

SHA1
6a2d0db5c2f4a8e19ac48bb9552c426b999c7e7b

SHA256
7e25ad8030fa0d690bbeabdc391552cf52021906a04a9b20956f5fd1611d0fac

SHA512
2a57aff9c4951bc646e739a80c6258a16b42109ea640fbf061721763a2cf05e6eba7b082148ea15933c30dfe1f38eb41df0f15904c41c977edd0445d1dc6da7f

Download Submit