a0a27da6068021ed4b84c2f8062303b3ed7c055fbb50f7aea40209f65b4cf4a4

Analysis

max time kernel
489s
max time network
610s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Kiwi X External/Kiwi X External.exe
Size

321KB
MD5

9fef2a301edbcd80a74670f54a88e41b
SHA1

eb7a5845b2998217f8ebd4ecec4ba554d3edb757
SHA256

02ad64a9b7a3e99337b59f54563082fbc48b26cb796fbe1cd834ce185fd63381
SHA512

afb5badae34091bf88b5e97a1742385cb7ff4839f514ada697da00ea186ee0a9e35c53edcddcabda2a7f4d0cec4e2e53ec897033ec1856c05238efda07fc05c9
SSDEEP

3072:JIl9mTYDNDK36o4zEsb3q3BIIi4bZIYl/I8Z/mKrGqx:JIvK36o44QadTWYl/IK/mKr

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 121318.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
2508	msedge.exe
2508	msedge.exe
3140	msedge.exe
3140	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2508	1944	Kiwi X External.exe	81
PID 1944 wrote to memory of 2508	1944	Kiwi X External.exe	81
PID 2508 wrote to memory of 4520	2508	msedge.exe	82
PID 2508 wrote to memory of 4520	2508	msedge.exe	82
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 580	2508	msedge.exe	83
PID 2508 wrote to memory of 4660	2508	msedge.exe	84
PID 2508 wrote to memory of 4660	2508	msedge.exe	84
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86
PID 2508 wrote to memory of 3836	2508	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\Kiwi X External\Kiwi X External.exe
"C:\Users\Admin\AppData\Local\Temp\Kiwi X External\Kiwi X External.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffcc7083cb8,0x7ffcc7083cc8,0x7ffcc7083cd8
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5468 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,16185067147191866037,14400575309569425010,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4732 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c48e8b68231fb5b2d7f1188b930bc0e

SHA1
1822aef5da8fdd47626fb91afcf79a2be175a325

SHA256
c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944

SHA512
2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2dc80f5403feb8461b7ffa09890d6a0

SHA1
d5b61e6d672e7e71571e0132e21cead181da8805

SHA256
eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a

SHA512
5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0bccf461-2988-41c1-af2d-e267455f8982.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
61701a0737e7d8d963260779312584eb

SHA1
64f77ae2f448ff4de26fd4ad6c298066a8633707

SHA256
b928faaef3769388d90cbadde5fc35bb395ee314c87151b13c32adc675b2165a

SHA512
ec09bae43d9f90a68a8cdb705e185b56e71a1d9f645513bd4a02f85b1b84be2c623fcec0a58d178e62779e12c8609b585ec93c40de5591ee968d983496e89f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
6b936309038e99eadb50267f020edd5e

SHA1
8ecdeeaf047df8cd39b0f5bdbf96b6fe1b2515ea

SHA256
b985915cd3b280172799dbc517b98280b9dd3a46a511970c4be7c9d2ff03d679

SHA512
5b691924977869a51753b58e3749a7330f55d961b56cc350d66e8c90977e0d4908253379826c4563bb7c23e25dea09929bcff1cd2e8db63e0cb808542202c059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1435018178b9e7b30918abe4bbfd01f9

SHA1
1efbf588c1e221534ac63f11009e7312c4816729

SHA256
033e4e42d83348c3bd0da08405e2a3712b2d9252fe8b867932ed815571926632

SHA512
f3ea535cf1980c5a82e325835e06144495385ffd8630419e5ce65464560ac21e3f2e03f8eef71bc7de41c2042a46e3c00ee68fea56f4b6b7eb0e26532a9d26c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2bc8e5a3d0908a9a5408e44a9728e3f

SHA1
54276865f4431e7c21c2b17384ed74722f2c9c4e

SHA256
5610cec29dca0505c1fb183eb98ace95d3105266b9f53de40b651269eed1c89c

SHA512
6cd2d982840ee5dc8236947a018e2ef8d5c6d6539016d3d81c581de52e3f8916c14ed0741835957180f29b736215fef1a9c8ad086598695d1225e6d8067c5497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
0fcd17e477dca45ab56329d10a47d0be

SHA1
b77bbf115e535cf2095a305927563a36f4a01d11

SHA256
0d840715bcdbdca715a031543975f166d4c76506c0f57f196be32086ec1a4dda

SHA512
8170bd5bb2063d37fefd26b713120b4c60f0b4f70baca9c5572cd69b083508971e71ca3778a9fd0b74cae3f57a0e698080ee149146041add8bceaca43355a353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
8c099a154ccb6b0422ca2cf412b07db0

SHA1
6914e151b6fa37f2ef2670e9e8ca71c954f7c03c

SHA256
9860128d573d7c64b154a88715f7cca07f493bf8bd9c72e373362ee40e5ef1cd

SHA512
c163aa53fc3a1686dde10a8591c2506c65b69fcc5d0ac2d93ef6ff936bc307e13f63d07f3721b6975126687a1f621f035b6996a91ab12d96290bbc4923fcc8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
ac393da78c50b347305a377b99233b45

SHA1
3127d2b49229346e90ec5347d0bcb238c7d17312

SHA256
d0f154dc862745fce408c5c230ce1a8c8428c309f7ea4164773019d0b5776d33

SHA512
9c440688d453d679a3f179da2e27441bb6b4e2a42f5515eda989a0fa507ded75ec15e04dd959daf6eb9c418f1d2b53c924ba1ebc7485c849780f463ee69a6316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581076.TMP

Filesize
371B

MD5
e29db09bfd96694d5b44fe46654c9f0f

SHA1
93e677406850697f84da54243a6a504b01d672ce

SHA256
71a4c94cff586055366e1d8df4ad73ee0ab54de57e4d446c21f36665fe3a65aa

SHA512
e2029ba2e39968800d044ce482f960751cdfe7af0390097b6063c3a29070406aef4ea75314d6bbb10b697079d985844c34d2f65f0dad742f144b50a5408e355a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4bc0d602e17682c87c4c5e9af8a791a8

SHA1
ca07ee76b555e4bb139040053196e29cbb587ecd

SHA256
bc3a80422614a5bf6a8d0f8a8f4c68ac3aac8b6794819e50c562965ce8699c25

SHA512
236fa5131528a345ef90d59997cc4e62028b812b068d8cbec68ddfb8d892c28e17b800d23a5b3b07225be71190bcfdb1cb37055b9f9a4b94f2c1ff5389d53218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a8ad7b5b90149f0d44b8de3d1ab72b99

SHA1
f1d85aceb93aa8ed5be4a5ed0bffaa1f0397f097

SHA256
2c4138094ca39d8f00179656f75e9d189e63325d74ab7dba21e291d022852125

SHA512
93abcabc054869f7cff357def3bcb90c122607474cffcf3983bf2a205d1d6a98d7691f21ab2969942cbedcb00aa92317bc3d847f67af9ca4e6d5419647e3d8cf

Download Submit