hxxps://www[.]facebook[.]com

Resubmissions

15/04/2024, 12:07

240415-pajw2sgc8x 1

15/04/2024, 12:04

240415-n8w4lagc5x 1

Analysis

max time kernel
138s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.facebook.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
3800	msedge.exe
3800	msedge.exe
1456	identity_helper.exe
1456	identity_helper.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4952	3800	msedge.exe	83
PID 3800 wrote to memory of 4952	3800	msedge.exe	83
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 3476	3800	msedge.exe	84
PID 3800 wrote to memory of 4704	3800	msedge.exe	85
PID 3800 wrote to memory of 4704	3800	msedge.exe	85
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86
PID 3800 wrote to memory of 4388	3800	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe85846f8,0x7fffe8584708,0x7fffe8584718
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2893023074147341086,13516627144855044720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
16KB

MD5
5b1b948d51337905facc0b3599147c47

SHA1
8bb653f3ef007b1d778393aa446497dccc90e121

SHA256
cbee582dfdd0b9bdc67d6f9d199bed9ed0837966e653119588a4cf2f3cbd3bf7

SHA512
d78459f3fa2346ba4eb0a458f07dd63cc32fb5755ee365baa524d7856cdf08113f4e02ac7311daecb2904520cce4a7a5b25b9a48c9d9afc03981ebe7706d03d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
16KB

MD5
fd3f446c3cb6c56f7fc37fcf2b7073bb

SHA1
9eb521c686decc629eb4f76679526904b6faecf4

SHA256
e21b6742eb1ab84ff25fcb3f36daf76dbd51ad0b22d0c75def43a2c2844baee4

SHA512
6a38d94c45c0685a5da292273addb846124e425fd1f12d9a5dd60dfb2047f3bf0dceb19089d32cb70d88084dcdc4f43834e3dadb22f6096e63bb6f1854fcfafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
4ccb6d5d99a6707940133145fa889147

SHA1
9e55953a1f69c7b9fc78d4e26ccc966c68307010

SHA256
5aff2bc5d39e8bc6290a18d9f9702a60955d84bb0b2aa0c9dd301f07fe0014b2

SHA512
1ba52d5f46f7c9e3a34304b577e6dc041decf07c8aa1d44cdd64a99428900cb48e0f3e56ebcae4b43038265d39d3abe981dedec392b8c61acee250b40948f63a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
c4011d1176883857e28205071ec2e3b5

SHA1
f024daed136c6354d03f262817556fe5b98b78de

SHA256
fb130bf69176fdaa42085731a885bdbdcdff160317ca81f531189d3f19ed3ba6

SHA512
a85034e9158eb90315ec5e54a42f0c618d40d386fadc9101546b3fb836fd5c130a0fff401696becbda418d70a2a5d2059c7b3d5d0945d8f50116a83c8f262047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
328B

MD5
88df7435f3e6cee126a85f92bc01746c

SHA1
074d926ea8df06245bc88b2302dcd4f4a3294104

SHA256
768dda5b0c5f36658318b5f3efd26c7d5cd933bb123c615ed9259832958bd1ad

SHA512
d680eaec5ad9538ffc02e9633092948aa740a0b72261b7abfa87eae0d10419db5519bffe58148171054755c572ebd08bca5b58a6bd3871b031bc146318057a3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88f6af49d031843fc3221581a7ff3e38

SHA1
b1f8404c056f248a43d562bf09c91fc3b39ff77b

SHA256
461369d55f2eafef0b0b95795c20aac2344011f43778112ac052e5b5cf520556

SHA512
7f78fc55afc63419394bb8e40ac44879861ca5175b09e42d047c491f6734267f4087b5cf3975d4a8a1df739d9d65dc75251c6ebd574faf9d408a325dc23f723b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07f3d5bac697bdb16de040836c09a8ed

SHA1
6539ad6801978fa5180e65e108575583d64f1d57

SHA256
c8a19de47c9f89c9982ae94f5aa803f7a3655e89071f5b2220b566516937b11e

SHA512
4ccd37a0fb3b5ca31eb0b701ba13aa0ec238cd5135a7967bac87568cbf0f038170d61617ada584e82c259cf725caac2cc9d9db24f5db789739cd4ef4e53dd664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7de9a04a888e67a7a78a62d7ba26d34

SHA1
3cc4115ef0c111e39635a2986d2ea491006b3a5d

SHA256
ab32cda6c1dd4cd8417550caa4b627276cc611f147ac3cbad90c02b10fa8601c

SHA512
fdc02a2dd7b101c3b9d8e12133dcf9ecb69fd4863b35a36059a4975f236dd69dccfaa7fa037548cbf4c78583a7bdd059fb473ece127453600215cfbe279d5887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b078d4ec7b17a6aa9fec6458db8264d

SHA1
a09c949323e95333a38fb96e016d0496fce7c69c

SHA256
c4c7d78437600754b04f6e4314896a87746fe972faaa80a7402e1f2bc7360f75

SHA512
853c6f5897a34be508365802e80467ccd4d43b6e46e5f5a811dba11a48d810a1e5f50902e3f2bb94faee86fd6e7c918fc0f2a5bc68ce43b2b71d4fdd0a8266d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba261a1096c670e744b334f379ef85b9

SHA1
0d4d533d91e9b783a3bbf8e34217203caf67fde0

SHA256
2156f368e7d21547351b34bb0944b05484570ee377063109e121970f4f485bfe

SHA512
9eba2ffb4231a2cd0d4ec18ccb93149448f8f194abe40456623df8494c9019284298864d9863a12e727bca761e41d91dacd2092a522a450ae4ed5a2d1b309e1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7da9895c6a1cc800706e36ee948691f1

SHA1
0fe81198284610590ec5b266d82acdb9304c99e0

SHA256
4be41a4b64a0da1d25bcd8afd06d9f7ab3c7dd17817570484b011850ecb11a1a

SHA512
b6bc302244c0da7554e43144cc92663ca3c98345aa76901c395e4f397ef7ff524ce5641b15e3b904f6c7dab89f8ec6e0606722d2f9e5bc10743575b3c8fe1d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
7c2f4ac3344e8d51142f6e8bc6193b76

SHA1
d770fd424af0adceb702ff3708fe573931f15d11

SHA256
842a813dd981838e50edd6060ee8ef9b815f05d0f99cfbe3699b68b00895a761

SHA512
187173131fb4c5e03548a287d6b2381493f2f166e123ef4a8a76846413629d2dee4e406e62a0ae52217aeda66e0072221d17d3f7301f31a53080333a2535099a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
dfc833bef9ae37e3f059dcd90416146f

SHA1
c11627bf4e8f284e117fd60d28cc71370b1c44bf

SHA256
77804b5b9e49d1c23c89f55e6fbb7e9f2c2495371b5e6557ebecd82c914c0d34

SHA512
5804e2cb12cdd11e6636b936ff1647df68783fe727f2ce1dcf9abf15ec8fecd9b5a347fb29a214e7e89985d1e14f5f618cb3c6f3c2e9c08ca8c213048ad4e7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
dab092a7ff3ca8900d4cbc6cfe8eaca0

SHA1
e08bdea30513551961160dd487b42c1353454d24

SHA256
5ec26d6f50d0d9708724ca4f69a7d4ede6886896c25a022e4039f26440c7ee20

SHA512
8f47604832780e362e04d83682a3a6f534d41474f62f9aab6fd6fabf2d1c92df0aebbfa44d99e7686b52ce4d2f8f9bf86e93747da51a212bf653dc6acee9fc15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
3a8d76d6ee65a9cf733481fffca24fe4

SHA1
e24277727a41218fd40b6af72f94ba0129aac756

SHA256
109ac365fd424bb916a480d11a7830bec59b44564462b5d23354ebf2c6934c9f

SHA512
1b96eb0a4cbff0b6a0dd166c0962ce805f211096b98ef30630db23923d37a82c57f13b486737d32b1574717de37d8c4cc2f5e0e35b17ee2a72c3558d0d9d33e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
07b8845449dec2bca40fc1349724801d

SHA1
650f83b7578161089080a5f396f98cecf9f46cb0

SHA256
f900346717bf52cd2b729c6d31d314702a0fdd3651e144093570094d1631776b

SHA512
7ce112a6360c16526dd52b29e1e915131ce9238ac6476c4ad094856c8b824bc4a247584d45720fd52c2522e1c8d844c27843d4b14dd67dabc391cd2b009c4b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
258236d786f2d311721fae5053d7bfe5

SHA1
3809a8fa2ba4a912ea9367dc84712b53cacac0f9

SHA256
3ea8fc6f5b9284111f33aedc41571e61f2fb24830d485d19fc6f68869a0d8c41

SHA512
a54db0908af86c537dfecd9544e114ec569f1658c1cac649b934b7fa5563a0d8824e0004180c08d4402f74aaf06b733bdd583de614837c8cb900b26271b2267a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b026.TMP

Filesize
705B

MD5
fb4d54817d96f3a0333fb5885967852b

SHA1
4b4fe15d21df2c8e203c5c054ca7afb7bedb129d

SHA256
995c3c7f603a2964a2847f545226d1ef2bc391cae28539407a9534cfb7b163bd

SHA512
0c4f176b2739bac2b6eb25dca1ed4c30bd7f6bb6273ceef0fbb5a1a731e923331a630f257367c89652662d0a070bfc7d66e8ba48891a859cb672063c9cd04c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98a206059d763d9b035d659eea9b63fe

SHA1
ed46d827bb37300b9186723328e14da5918faba7

SHA256
6d89168ddb2d455c333551da39249cb889b28074f7aa7aafbdea3ead05a13c3b

SHA512
986774c6d1dfd5302b908190be7f8c42dabeeb136b4e021af9af380bf6380f29a3298dde64f8505a03ccb78e820b7af22ac970e457d112b19a0fbe8a40ef4c5a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit