hxxp://whitegames[.]pro

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
24/07/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://whitegames.pro

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1210443139-7911939-2760828654-1000\{4C8B313A-C0F1-4BA6-9561-06579391FCF4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
224	msedge.exe
224	msedge.exe
4896	msedge.exe
4896	msedge.exe
1468	identity_helper.exe
1468	identity_helper.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2096	224	msedge.exe	78
PID 224 wrote to memory of 2096	224	msedge.exe	78
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1220	224	msedge.exe	79
PID 224 wrote to memory of 1540	224	msedge.exe	80
PID 224 wrote to memory of 1540	224	msedge.exe	80
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81
PID 224 wrote to memory of 2108	224	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://whitegames.pro
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff951f3cb8,0x7fff951f3cc8,0x7fff951f3cd8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1716736808555271429,16663920995363207838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
afe63f44aa3aa9393e4251b4b74226e3

SHA1
29eef15e4d60afed127861deebc7196e97d19e4a

SHA256
7787181844d106768f78847869b5e784f07c1b65109d59b46932979bac823cd3

SHA512
f0f7951b5d55c2cbb71add5ab0c2ed3617a6fdf93f2c81ee9dd15d9f7c67881b42cbfd97cc4d2f17ba8a383624b23da1897fee069ddcee34233c1f625062a1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b0c53c5fe6ad2ee4ffbde1b3384d027

SHA1
0c9ae4f75a65ed95159b6eb75c3c7b48971f3e71

SHA256
2e9fc3b050296902d0bb0ce6b8acc0bb54440f75f54f1f04ae95c9956108171f

SHA512
29f62e085d685d3b4902515790ab4f298454d0f8d53b6234fae9f9a0edffdd0d4edee57261e8eb0b94a4af8e86d3f7ab8b044c6f259576b89f91183002e58b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
94307044f0448b7e6d5c045fe757adf3

SHA1
caaf91145bcb46679e10127852259f809a25b7b1

SHA256
c3f28d61dfd00a22da90d4ce2beb6a1c9074e78604991714a362151252943f5d

SHA512
f439faab3dc82c46d00e5be44a39b3b19c7666f0703436952815ec37c3ad51f177efafe38749bf5deac1f6c72ea3fdf66a48cae35d6d63530930adf83b38c4e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
267B

MD5
185ef3dc4f7d58de11e1e4be2df9dfbf

SHA1
c83e9fcee88a97d985f698a0651d6400a3fa82bd

SHA256
8875ae398ab4b80630d64c675e5bac285159ff3a19887af53ff420dc5fdb3002

SHA512
19b53bcae26deb79fbb274ae8295150404b9a80f91a3fc42f4524a96c1fbbcf7f2b0a36bdf2b451b61a01304c0f432a234799b2c489b5f86684998ce159c6bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
199b660ac13c100113d5ce1e21808773

SHA1
b78e42fa16042a124a5e7c73a23e3e26d953eec7

SHA256
01a4b051f22145929fd82490280718eec87cb281d5e818b454e2b29f592d6120

SHA512
a6e9de80ef1b871cf566d2ac71cc5778591a19392043018984ff8f314ac626f825d3031d8d46adf6b8b5e54a77a7ef14f5eb164f999683ee51787f77554f2d47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71098211a705e483aaca2ec73ee0ea11

SHA1
2ab516cb5b0d77a5b70aa8887e588e2355728e16

SHA256
fc95e8078f83bfd758cde6417fdffda8ca83b9c00d93d757be644ec21ee7e1ee

SHA512
76372b846c5ef03580d91d58ef00fc54ecd030be9a8fce1b3eacca3bb92daf0b27e65b41a7c6340001543145908d9012878ee808a024e5ee5c1e311acc85f2cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8985a250c82c2c43390273ba01e90dea

SHA1
89fd5b9d4efc73d16b50aa10c11a9f54ebfd3511

SHA256
fb32e8b2e47c58bc2fb4c9e694abc11ba7486488f71c7740349a97da88a8f8b5

SHA512
8bf0969459711792706cf6b03d5bf93edc48aa512ad3c9ce52fcd72fca993ecbfc8f223e6e7dcfe1d88e64b19972206edce9b9a3e57f14bcb288033841cebc27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6014de449de5fa507fd4fb5ee16becd1

SHA1
80dd0d015a0a4c1d3d6f19c70dc5fc25388e9e9d

SHA256
381d8b70948fef2019b7b030846656aaf342ccd9cb8ddd35bac0a085e8368170

SHA512
d98f17a75e5704e5af7f5092d79a4a3710465bc9ab3b8492b1fcc41d6040d3c0c9babdf423395f01a21125fb1ffe6cf8c7173a8af1f78812e6209e8a9e968722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
ac57ce312d7f2ad8f2c0460fa12d35ec

SHA1
1be82560be923e6a335374b023b8071a3daf91ee

SHA256
d5fd07d895e519d40bcb180107cfefb5d1e091466d08c0d009ecbb866c1432ad

SHA512
2441409aadca85b8193fd77a694421c4017f38f006be8e5a088d02ca127a2af076c684258adb98211fac74c5d39233f7499cf65f2d811ae82baae767f4c74c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59d8a3.TMP

Filesize
204B

MD5
987a98a90f11aa98c2bbe8e68cf44b5a

SHA1
678221af330d38531cf8d7724a3b0a660574b634

SHA256
62c0322b55e2f528a8716eae24e03aba810671a1c089663e210d49f70f413d85

SHA512
a1599913b3e4abbbbb69f11a067a6ed27d442e53a33e1bfefe659592ed5312b37aecaa02bb0c4806e58ac4ca15201b05572396b3cf41e06db885ded881c840f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1ecb3609f37d157c4476b13189682ce8

SHA1
db797b0cb7d0dd9fa0cd9c8c18b2c028b8a4ad69

SHA256
4e412a68a8e1b37df963ea6e058815f1bc0c62ada155993d64389cf4325c8e06

SHA512
722a240bb1013fdf56095dc21589819f64eca3a22272ff12ef187c09a228bcee70a14a036926b837ecc2864fe9be71f296325a367e3c9615e32de86beb2b8f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af6431d78f4e6975beed4cc8ce848acc

SHA1
bc30c6c6bedfe8bf40ae6df567c284c09c6b9e57

SHA256
67c7ef8bb714d9d47a8a83435f8ece26b7adcbb9ea57170bdac083fe6831ce1c

SHA512
57f9e2ea58538f4be71dea6678829720315951a3be790e00789f12537832f347e7578dd24f670de4e79b059cf538ade7959130519ceba064bb6607eeffeb7fed

Download Submit