hxxps://zoemox[.]lntrlguingdates[.]com/?utm_source=da57dc555e50572d&s1=208119&s2=1966185&ban=fb&j1=1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
04/02/2024, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zoemox.lntrlguingdates.com/?utm_source=da57dc555e50572d&s1=208119&s2=1966185&ban=fb&j1=1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
3112	msedge.exe
3112	msedge.exe
2100	msedge.exe
2100	msedge.exe
1636	identity_helper.exe
1636	identity_helper.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 5052	3112	msedge.exe	77
PID 3112 wrote to memory of 5052	3112	msedge.exe	77
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 4728	3112	msedge.exe	79
PID 3112 wrote to memory of 1556	3112	msedge.exe	78
PID 3112 wrote to memory of 1556	3112	msedge.exe	78
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80
PID 3112 wrote to memory of 4020	3112	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zoemox.lntrlguingdates.com/?utm_source=da57dc555e50572d&s1=208119&s2=1966185&ban=fb&j1=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff988573cb8,0x7ff988573cc8,0x7ff988573cd8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,6652082467156884410,16390844339969226823,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5cabc17286e25c0ade7a7f050b6e92a6

SHA1
c25ab09177ad0da9ee6caf78310236bdc2cba319

SHA256
0e75f9140c154297d8f741aea07b90fc1be1b8deb79c3f204148471800e322b6

SHA512
0cc35eda0168f51e5e719ba0bfb226c9f5293a6056d47190a23377deb98244f42c62b8416696cdd13b2db6228c1c8a2513cdf6dbb1d4b59f0c1c889d1acee6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47f6faf9-dedb-418d-9ead-776695aea7be.tmp

Filesize
1KB

MD5
fccbe2bf1bd3f54e3ea77c409173a60b

SHA1
e702a17f0e590e5231455d5b98bc87224b66cd6c

SHA256
d2fc978b87b7ab2eb89afe79fc92e655d608351bdca2eabf0762a1063a1072f6

SHA512
71c50f7d00de290693df0ffb80f9c8785a6afe0d5ea6731e16c4a29f28b14030f9b2b1e81702b9eebc49ca1f141704d47f14d91a0dbd94065191a45d52d3d1bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
a04dea4b37dc46d820cb8d2f1fbcf55b

SHA1
2a845ecf3bce98bb833556f0547f52a52d2cb4db

SHA256
786e8f681782ccd7f4123f5bd4c2ec5921016f7cdf8131ee78a4c014bc545570

SHA512
23047dc513c4f07d8302be7f064f2ea002a6eba5d9ce8777c8f3818bab2fedbdc17e14873b7b762084dff0c76ace302e0b811f2bd3ce0409a9bf89e9d2412131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
b791242590ebedb99cdc42bef2ab0ac6

SHA1
8b6251aee30bfd180c5a8e9b2990b1ec0b7ca180

SHA256
70f57b1dc553dc4be22d9b12d41697f4a578bed45f77f496302d7f3db014c407

SHA512
b6cb13e56c0f4bbca9a130e0686988ff5ddfd2e593aa0f2028b0274448bfd7b50b51adc2c8c988b707dfb1c2f3e51f7eba4c328a9bd70a2f206d9c5e7e071995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
79a7a0cda317db37b60ba4dfbfcc50c9

SHA1
47cb24881752f4012da58253d2c5d9b6e38c6c0d

SHA256
60828c8535c1ca93c423cf62f2863ef656ddb2559673c3ede0f87bde6a5fbabc

SHA512
28d311b7b1e9b8187bbb10f84ea2b1d8471a4cee57255b597333e332236bd497b4608e994caf878b1943255f3bbdc545a43dd3a06da58b072d7630e5b4138be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
866cd2ed362a4368c245569d19eb07d3

SHA1
ced2b0a7979182a9cbdadde3b50c87aa8c9df423

SHA256
163e46832d42816ca9dd2c707c46f367f788546c0adda12bafd59cbe43539f57

SHA512
4eaf3261c5bb6589c44a7204787aa6a5950277553602d1d2252a834a5a7713044ee21f169f1f78ff7c2ca209c8c414ef43f96e7f2d39ddb1fad04ebdda90760a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
64ce2d0c910c4a301520693b868be5cf

SHA1
bc72e56587c6c39da30a1b7c14152134d3d97898

SHA256
3555b749135cb88e629406716e3e9fc75cb7ab89788f7a62f5000fb2dd776f8b

SHA512
3ff086476bb63a6b01fa4cfe39eb6ae959caf70bd476e4dd2f1e08932c7ac550f9f9133f7b395dae190aad70ab37aa92a5705892b2fe97c7f824bea809616896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5e7589fc2422f07380738fe612918f5

SHA1
7a30843cef431c15f0e0bbd800c2dc1520d21a7b

SHA256
7d4f74a63f8334fe55604bcfabe1fe77a88b35a17bb78f15d91565ca5d4ddd99

SHA512
172086eb3c2f68e7c533c651dca4b38b9c1db7bcc89a0936ce564d7ed4e3af906c55812ac7217a6beda15f3542e30d99a3ea40baeb0f384ff991d422269636b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bfd9d4e4aab9cb1058faf244b558045c

SHA1
a103692f60e9d1278f438aa3ed6b0ef521f04539

SHA256
79d5de1d792bb20dc31b6db2139fddc8709358cf5639bbf8089773617f063dfd

SHA512
25ad3db2d2d3317633c0fe5cb47d3a579edabdb5569249f43b8490ea1d54eb8d5dc25e196819ed57c33875725e3be1e9dd1695557226a9725e34823e5d605648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25f80f079bb47bac806a67fbcbef5f0d

SHA1
ce73c697ad77f18bdee7167b907c4a0b7f7515c3

SHA256
779f35257dca13975631b526a47f3f8f4ed211b6068016bd16230cd0a38cf3c1

SHA512
7d43301a13a66651690901fa48d42835dbc2f16154b40e90118188c828edb8179164d607897de8aef859b17a26010d5ea1aceb61c129d40c5110be55c4702d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
68fe6f34e7d6603a3d2f4c95919f8408

SHA1
c7be30582f94d46f05338cc39726f72c9e2fa4cf

SHA256
8cba909149b2d3fc45315cf63cdb8fbe42a4b7c614347171ba00aaf859639c1a

SHA512
48eac2f55675b01ebeb28680ed9af6dcb9c558f76fd647cf05f8a7e1fa04ee57f7a8c70bc0ea882bdbca48b29d62ea7af74b76a03b09c19762e4c93118929be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5831d9.TMP

Filesize
204B

MD5
b253ea462987f7642100af85ebe615b7

SHA1
1cdfae5b372d98e77fc1117c892233de0ef03421

SHA256
7bc4ec5baecd9ea27dd7eb467769f01dd57a216faab3195460f0e62ad6278704

SHA512
51c365db601097c7c33f23c8519435fdd284f216d5db4ed8a4d3653443e1d2e93b2031604495a4581111727cfb026d129a698e083a281968ab5b3a72203dfede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a4e1dde4c64f2e6cfcef7a9a0c1a51b1

SHA1
f4850237bf3b69de6e2a55e32c16932f1e98cade

SHA256
5f03e47fb3777ea9a70de21d0ae19ca3b8e6d99e238e1c92b4766aef5e667d5c

SHA512
d1954b59372cea688689f5a578c9a54b61bb0bc714b8cc74fdb9b55a761dd17db17ecd05ee10c61de57c6f3a0e00b470cbff2d64c1f3a05c88cd75689817c675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
52aee05d8481db77621cab0862d80567

SHA1
0452768c88478cab2396b762879bcec6ba04edc8

SHA256
212489a500fef69e71c6a919a068d5857a85beece107c88c38815df021ef2f06

SHA512
6e19a53ddc14720e223ec6569a1def5fd7491f1db4ee1cc08acd8645f4b10b5f7951bc862c73446a1904fd71d8907ceffb4ad542abdf1e1165cdf0a327c19a7a

Download Submit