hxxps://www[.]bing[.]com/ck/a?!&&p=9e4384fdbb7055baJmltdHM9MTcxMTMyNDgwMCZpZ3VpZD0wODk3ZTBiMC0zNzRmLTYxNWMtMzA4Ny1mNGZlMzYzMTYwYzAmaW5zaWQ9NTI2OQ&ptn=3&ver=2&hsh=3&fclid=0897e0b0-374f-615c-3087-f4fe363160c0&psq=download+tor+browser&u=a1aHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvdG9yLw&ntb=1

Analysis

max time kernel
193s
max time network
213s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.bing.com/ck/a?!&&p=9e4384fdbb7055baJmltdHM9MTcxMTMyNDgwMCZpZ3VpZD0wODk3ZTBiMC0zNzRmLTYxNWMtMzA4Ny1mNGZlMzYzMTYwYzAmaW5zaWQ9NTI2OQ&ptn=3&ver=2&hsh=3&fclid=0897e0b0-374f-615c-3087-f4fe363160c0&psq=download+tor+browser&u=a1aHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvdG9yLw&ntb=1

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 313880.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
4188	msedge.exe
4188	msedge.exe
8	msedge.exe
8	msedge.exe
4860	identity_helper.exe
4860	identity_helper.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4164	4188	msedge.exe	80
PID 4188 wrote to memory of 4164	4188	msedge.exe	80
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 664	4188	msedge.exe	81
PID 4188 wrote to memory of 1392	4188	msedge.exe	82
PID 4188 wrote to memory of 1392	4188	msedge.exe	82
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83
PID 4188 wrote to memory of 2364	4188	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bing.com/ck/a?!&&p=9e4384fdbb7055baJmltdHM9MTcxMTMyNDgwMCZpZ3VpZD0wODk3ZTBiMC0zNzRmLTYxNWMtMzA4Ny1mNGZlMzYzMTYwYzAmaW5zaWQ9NTI2OQ&ptn=3&ver=2&hsh=3&fclid=0897e0b0-374f-615c-3087-f4fe363160c0&psq=download+tor+browser&u=a1aHR0cHM6Ly93d3cudG9ycHJvamVjdC5vcmcvZG93bmxvYWQvdG9yLw&ntb=1
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff941c13cb8,0x7ff941c13cc8,0x7ff941c13cd8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,8535134235791101170,8795024659391941298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12b71c4e45a845b5f29a54abb695e302

SHA1
8699ca2c717839c385f13fb26d111e57a9e61d6f

SHA256
c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

SHA512
09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce319bd3ed3c89069337a6292042bbe0

SHA1
7e058bce90e1940293044abffe993adf67d8d888

SHA256
34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

SHA512
d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
55dfd43afe6c7d7c171977d1542c4be8

SHA1
529de3a929d8b753bdd41f5aac957430ad3293eb

SHA256
ed5d599d8fc04d6ea84a408ddede0f3392822c5c2e561929170355fabff1ca71

SHA512
f28a7a6ba481782897cadf09e0f193e49566b2f40007358487e077da84616cc267e02772385eb5b20d892130d00b3099f62318e8d52c28698442b4600f589e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68d5cf0e3875ddabd1fd7f39a556620d

SHA1
d6b085053a9ec276533a84cae848a60f87c0b650

SHA256
165d60f25368bf55e20fe5a334da249dd61bec065d81300073e4d0228cab726a

SHA512
bd2841773a143800c0e1b81ddbdeafade3965ab687a65d32e0c11430fba100128f7a7861c284121629274faff1cbadeab03beb4241674a9abbfbad031c482295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d18fa821fe237f79bbf4f7cf3c543df

SHA1
93b89a1a4ab920eb08103257390079d5eccb32bd

SHA256
877e3702c859c7cffa5aa2b554ff8c66698038a6afdf3eee77366367f4d8befc

SHA512
97fe9735e230099488930a30c20a0447dbb3a61bd550a018d4fef35f8c6bc835cbc76070bc485cd3bb7f3eb3f375df2af8d4e1891aca8c050556625b4a480d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80d42dd5c321cf3cdbc2f02058e186ad

SHA1
cf33a2ecadb1578bce9ccf56a0a20722850a15d4

SHA256
b4a26b8be5283700d5ddf99555393269192b9d7d8128c9e3904f603ff5054d88

SHA512
4054e1695237a0604559abe629464a464bfe62d2a26e1168f2a05f36385ac0d7418b819912fbe8077c9ac0ea8e2d45b2a0d72366889c39df3735068c11452609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
160fd6b1267f4d9f7f42efaf76a167b0

SHA1
8fe96ed679e88d8ae76f865b233b0e140b1a3c29

SHA256
84d9137d580c377137110e633b95377811a1842ebb9fecd6deed4007c5dd8187

SHA512
00d509fa8bb4476d6e1a3733bc1729948912fae25b7d7022fae8baa98ac8cfa99e81a24e19643ddc9976fd614665268d5053be32b96c96c3ea56836a5cdde5aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
7248d66c56464cd5cb60bf9f6cf5c10c

SHA1
1288672e79b7727c9b495ae75b04b37eeef169ac

SHA256
733260089f62ed78ae4908fec88ec25316d6dba795be48093095912a51c0ab3c

SHA512
90d9aee06d0bdb00fa144881cc6da29c1bf0b13f4e5dca917a12439582af58ad2d21a80151847fdb0fe65d61520379e7e985e2819a222417c217bfd3a7fa3c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582093.TMP

Filesize
204B

MD5
5ba5a1dcbed502b86c95d6a38efb2708

SHA1
85682b44d986641bd8384937a6d477b9a30c1d6a

SHA256
fe65c4909d937ce4817f7be90a303d8f863a2b7e643631e5dea737cbfea877f5

SHA512
cb0e13d777f7f045684f46f31a537e0fdaea1264448b5a2df7a9505ed1783134f04a0fd373422beec3c0e826e12e1feaea5eca6892b60c7772cc8f7d715367b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
58fad2762eccf7cda993f90c2b6c9360

SHA1
cec57b4b1bd3dd01f1bd9a5a70faafaa14794779

SHA256
23eb5e5848a9d368021955b97c39a2465f351101b7b347af52f17448593ed49b

SHA512
ad24d9bb164892a924aae97e82bc227d0bc70d37c273e80e5ccf59ab13ba8220462e176dbbd908968635fbc410845e60a3996aef6ad84941e16d0fa084ea16aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1cbf67fa30b78ddaf18fb611ac92db05

SHA1
4f51296582e8a897218498422679ecd18871b3ae

SHA256
e524d1b64594ba6c1e3a5f0c5c263e60983f014959b9962c96070fd94371d8a8

SHA512
06a0b48ff366afb2c23dd3328559953a134bf2df1743dbb4146561390b54b1d4c3fb721d4eeca9fe86aa6e7d3ec675cbf9bc3cfd0a32a2922ceb24d3d8708c69

Download Submit