hxxps://soswebmc[.]cat[.]com/cat-sos/samples

Resubmissions

13/02/2024, 20:45

240213-zj4mxshb6y 1

13/02/2024, 20:43

240213-zhjw5aad69 1

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://soswebmc.cat.com/cat-sos/samples

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
236	msedge.exe
236	msedge.exe
3988	identity_helper.exe
3988	identity_helper.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 224	236	msedge.exe	82
PID 236 wrote to memory of 224	236	msedge.exe	82
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 1508	236	msedge.exe	84
PID 236 wrote to memory of 2068	236	msedge.exe	83
PID 236 wrote to memory of 2068	236	msedge.exe	83
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85
PID 236 wrote to memory of 4936	236	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://soswebmc.cat.com/cat-sos/samples
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9eb446f8,0x7ffd9eb44708,0x7ffd9eb44718
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,18285457120634041912,14499133658561619331,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
982fa122c1406b0b64fdf863d7c40334

SHA1
ffc7bb3696ee7452a05ad54e14a66531e83ce680

SHA256
94c66a03d8bcb905f88bbb5c39c4033d2630ebad35a0b30c8b1705eb26abb768

SHA512
97a4e643f0e99fda768bc25dd752e34569b29f5ac3b407003c2a23328e1eb3f2f06de0bedb93ff80ef828fc1c483e2d5825e0f1a409aef71c7014024c296c1d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
5a0ed02ee2b7d270280e39a58e3f229b

SHA1
5613e6f3c1565dd9b7f27c0d184e9537482bde6a

SHA256
3d300dd53b7901060dd4b70abc14b7de004c92282815d86ce20954bfb7e734fa

SHA512
08bff1c121cc841d0cdf70598bdbeb0073658d910b2ad8d1d8ce6108d32279684eb9b948dfc3eaa7d4fbf41726b7851f22edaf76f1aeaf8d28577371110ada1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
30588d9bda59740c5735d3d1e77c0a56

SHA1
f86666e9ddabc7e4f3daaeee32387a85620ee0d8

SHA256
e38e257221d5ed814225a93640e14967c1cf9171db3639d78ef942a502595729

SHA512
7297d745e9ccde47f79aa7e9855c64e57132e9c93d81c885da6ff4915c582db670189e45dd41f60de6016e8ba15f0bbff3affb6b9743039422af4b0f6d368de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e5f4716e973b9d901f08ff2e50e94af3

SHA1
f7ea98e3f5e3d535833734e5b8c1e440066a066b

SHA256
91940a8e61dfc81209801075b1c97e3a3ac19ce0b5991f2e042f7dbe4da78e26

SHA512
90a812a87140d09388afb14e5e9af074d2fb54cbc402b453c240a104db4930b7de2d9e444e1d8df2cfc523987140d8a7f3235e68f39834f93ed864d92e25051b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d4bc4d1ad345f5c1393e117442cfc1b

SHA1
6fec15053c4729556fa9477728d8e79ce057dd42

SHA256
732769fc13e167210ad601d036fca3727c5f7a7719c3bdaa334d92bd7daec853

SHA512
021f3705cbe2704cba3e93c3b49f9c270d2357d0e64abbe817a785052faab0df52e84145c50581a9cbc4e4622cd1f4a801117528630a058f278bfa9034cade61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2bbf66530b546e7a2d8ecf542158e110

SHA1
3de204e66d80b4ea534462e72863df18b087e3ee

SHA256
92666368fa5d8bf1cafc241223152cfe4fb064c911f798a55e9f87ea69963d90

SHA512
64992bcb62d3a84b0f726a6947b26332b4821cb3daf4b9dc156bdb17882a9ca3d609714fe5955aafdbb308af3628d409f2382a2b1b8115586745813a55ceb137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd378eedf123868d18651a9a2a49d62a

SHA1
1916fe5afbdd81cb80a3175e63b3b0284a89fc01

SHA256
01844daea5a36cc8e67c62ef80cc7bf199e26542cad0925e4e69ca02bc66ed96

SHA512
29a6f1d37e742c0dc2266fa6b307961d2d529a970abd04c4c96d199dda0d63eaeb4cf00a6b0b694a413ebffabfccd6582b16072bc901f457e9d16a78abf00fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8f22d8ce67c47f44315622c835bcd09

SHA1
46b5fd905646d708331ef46de5d796554fccf0ed

SHA256
2ca2bc9b0c47471271091031069b258badefe7d057c7b59d9feb4b283d09a22d

SHA512
cf9cc9e186e96c71c0a77080d153eebbea643fbabd36955bc9c40c2de23a347a316533ff262d3ebc5fad9f3677ec8c3e46ca90bd9d08893146f0bc5c9cbd8a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03d88566f00f6f37fa193724c7d1e090

SHA1
f2e458d4289aa23118b8b6dc21982068f4419c20

SHA256
0ab4d9b00f40b23fa3f58847b1108226c6b3f4f6b75d3d7ecffff45d7140f2c4

SHA512
3e12281496a9b1d21008f0ba156e073561c56b6bfec6b6cf3ff2d4dec47c9f13cd90b5882c309eba16735a1690472c80238f8eb782ae03c3ad80295cd4232c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b17fa621d43e37e1a37407f05a787d88

SHA1
cdd84018801a0255ce3a249358cc43d49378e116

SHA256
79532ddc35ad6742fe32f69944c198b3c30ad8b8a4167a727c24b16414e8b437

SHA512
49aabdb2902e18cf19bafa67c044edb4b847d89822fac7044d143f40175ea76601d300f6a6edaf49185d9610e6e529b596f6bf1d417b0d81b6708c4ac1c74951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
ec4d1555e9378eccc40303e8fd4af22c

SHA1
655b30713447eb6dad514b51e4a524291ee6f29c

SHA256
e09ebefc24b5bd05aa44457a303deef6befcc2363d796ebc391e5d23c6482efa

SHA512
bcec6d48a824b560ceb7cf5e58cdf5fb17d432f8da45fdb1b3cb409d729a70f4d21d36f3fa67d0f43020735edafbbb11ac494523aee01b323d9741f8fd17a235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
d16643227bb35794820105d659e03b8f

SHA1
7bc75bd15473a127ea6859114a0b86541b475572

SHA256
49688253937e58f79aa68730ce92e782562fc22241a7d4e784b90238e0eb029a

SHA512
1fa3c73beb064b6d314c8398d844dcb6938e62193a6fb7c33d06689a701a22184d786d60e128e03dd5d84a264ea7fb8cdf3d5bb27f36c641172704bf37ce44e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
26c1abe0938a3d38970ef922d66394c6

SHA1
8ca49b268ff7783479959a1288c0d77ade4240b0

SHA256
6d6c39e55fb1494cc7f97b39cef616fc92d6a7844b52ae8d6b08a70a21dc576a

SHA512
6f11cbc8e10dba896fa7a82b102bff344b8a89ea680be0d7df84e7aa3aa750325916818646c72b6a358981e7b8432ac355a8127bd335957f49fa586f8de692c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
9a047d2bfb3201643608bb22001d4458

SHA1
4e8d55c384da36b35e071f9c770741bf61dc279b

SHA256
6ea878b9b47da3337fa66119ee2abd7cf6845c46d850a661e6e92a441fd2b3d1

SHA512
698b76f95a559439f9a0e5a4396de45a4c4cbcc9e1f3992716e2dc64fa6f0b10066d028744ec43db7091c286863a9885300214946724c5b8cfa55bf166d454bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581519.TMP

Filesize
371B

MD5
731f29b666c0156d1a6cd4fc99fd23b0

SHA1
fb7f5436c851efd683f907755e3eb5b385575541

SHA256
51ea9882253dbba5090762c5488944c0adedd29d50f279cc59417c8f7caa3ffd

SHA512
d007b6bbe8a43a7a4c3e5a69726a5a22f3fbaf6028f56d194d854257247ddc814100f83c6588b0125aa0029d804366ef313658d92b9fb1fb57a3c1b6572766aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47232a74788292a11a853531225d6b56

SHA1
9e3642aca8cc110665dfb0f93a360676eda65dd6

SHA256
08e734bd503f1e7da768dcfdcdfb96af153023400fb2af6219656ce1980c1b51

SHA512
97c38f42ce3acc60f2b8a4ad0692559ab5706cff19606653f141fc08ce3a3faa14d0ded7640c6108b83dcf4dd02ef47a84d151d5f03df480e95d35823e5f12f5

Download Submit