hxxps://coub[.]com/view/2xkl75

Analysis

max time kernel
47s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://coub.com/view/2xkl75

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{F72295FF-8BD9-4A03-AC4C-0F88F5B736EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
4820	msedge.exe
4820	msedge.exe
780	identity_helper.exe
780	identity_helper.exe
1492	msedge.exe
1492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2420	4820	msedge.exe	84
PID 4820 wrote to memory of 2420	4820	msedge.exe	84
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 4088	4820	msedge.exe	88
PID 4820 wrote to memory of 3688	4820	msedge.exe	89
PID 4820 wrote to memory of 3688	4820	msedge.exe	89
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90
PID 4820 wrote to memory of 2796	4820	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://coub.com/view/2xkl75
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd50e46f8,0x7fffd50e4708,0x7fffd50e4718
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17351624546537010202,16795212098240042137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6175213b-ee50-4f32-afc1-fe83613f1d92.tmp

Filesize
11KB

MD5
5cb41adc30a56976d7c0f790e5f1ae7b

SHA1
ee5b511d7405ac724652cda504b343f90bfe06d5

SHA256
1f8907bb32daabb093d6bd6147e8c07b60657dd2b313f8612a2a2e74aa4be16a

SHA512
6a4be7c64c7761a6bc89252d295705de0f5cc161e7a8c3eedb273390bf1acc9eeebd6502148317731ab75601941027ab455d50d00421a2d027240b519bed8c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
29766bda57645aba9c3ef67cff4bc49f

SHA1
d3090b4e583b3baa5a0904bccde130a8cfe94505

SHA256
8a5466209f1ee0c849ccd83ab52a9111bf16218a6b5545df3212d0c2a49441a5

SHA512
8038f53a94b3c4a86ffc385c8be62a889c522b8b3247984f785da512fe00c5db17c38998feea40f4aa1a85bde71e630687f740cfdb80d33b5667c9bb3f130465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
75ead4fe1ffd8019257596b9e11cea93

SHA1
686b6e11a383e6c43bd5c661214ab4b13296b7a2

SHA256
be084bd07a2abed38dc32db6802a7a42ae8d6a6c33897d3d6b4031c2b1ac0419

SHA512
240f112bbf40748161245177e302407ec2c0b0a79186e26c869fc4b4d88cc28929fa2edcd0560cea975dc66f803a14bb26aa3b6f1bd541a6ed83ddca0ceafde6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
78b18f650958ebfc07d870722f2549f5

SHA1
5bb5c787ff75daccba32b94fcf50f34fe894350d

SHA256
b730b0589cdbe2adecd79a8ba1cc969592f788e876a9d3c5883e0f986a77c125

SHA512
330c8badc37618852d7c69633b05589ff05b631eca9526b420feb502d2315c8da2128780e0e922814dc9cf58515fec41e81b62c305f873840b6933b180635fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0565f814eb2b185fdaeea3168cce2db1

SHA1
7613dce0ec4fda41be5d3b56af0aabcf676edafd

SHA256
e9d3c903d0a232dd9cd6e20f29a6f0079257b6337cf8f1c812f6f238db0ecbcf

SHA512
f2b15a39cf9eb1f3ae8baef2095fc45d811088644d3ede8ed3af51f735a519b38a87e3f73dcd05d7807c89fe573392cae94772fa239312e27ce756ef8b014cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eda81446d755a43bbe5498c78215a7e5

SHA1
7a187dcb230a933dc2948d00580e1f2cd8311508

SHA256
7886ae9d0784101ca58aec298a81bb0ed5b84714f57b159f997cd326709feda8

SHA512
fb0edee4c67d5a2f2aa21307590b02bf7bc9e98cbc6618ed34ba9915cc55780fce73a072893dbabc119f6b997e90cf8f326cb518db7c5df9c9f48bdc5746b38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e903ae14bdeffc2ec1f60c03c9b1465

SHA1
3cf2435036fdfa8736fde19ed581cfef4e478119

SHA256
507b63b8fdb65ad70d5c1f3e8a3c8cf2977898b2fc1cd5f80deb55c321c17f07

SHA512
ba0378320185c6c80a8b5172438b0d20c5b88998309ee6b720b0f7502a3af32dea0a1f87d02c7b102be9c51bd8c553f628f638d3d8dccb8ba1a0192768d8d90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
62f35765ca7088d0f30ad81e40a390a6

SHA1
bdbaec3341fb3a5b08ef87cf43540d81c335464d

SHA256
0bdc6cc86127b3b680242757f3e8dea0dd9379e1e9ae5e2b434e47a47f6f8fce

SHA512
da5de3b048c7414e579c1e6e8172c70a41c29568dd13d6f7253f4bdde5e2213ae4aef456b6fec52943f37aa36aea371979f1e2af13c5519118f0413a48c5adaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ad8b8a345a90c99832b3093c3ccf9265

SHA1
084264342a64e4b8f22c21a31615f91e87d75e7b

SHA256
075769de28ba16decb8c2cad63cacef0c07c19c7b860f60092d80ed2fbb25c03

SHA512
f39afac797185d2fd865f01bba88d601311f3063196fdc5218d4e76cab8835670957d6acfabd8fb4f1d8301d86d8ba7c08d34d0dd4485b8872a07a6e0b0afdb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f2dc.TMP

Filesize
705B

MD5
8e875cbdaf94f1a7e53d4ccc99eedf7c

SHA1
42b84eb38c2d26bf28e94dee51bc7685ea79538e

SHA256
9c2151425bb7f5fa439db2702b7e8fc2b4d7c51c7762016511b6a9eec8677044

SHA512
df61a552ca18ca8a3bea72661cd1f559079b90b615f0a0093f942ad7cc180e751fcfee1f7ba195a3d840f6e5f4c52f0033537cc667f0e30d7d90d00ebabb5c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2efc953cf3ab8ac10b5bd93af8f83c44

SHA1
7966592f692815a0bda21ba72e80c278f17436cd

SHA256
b6c933ec3b4e0ee7633e0f0fa0471dae3ec30d4de2738644cf5fdfd0a2a1df79

SHA512
a2065fe8ae607eb42c784e0be32a53d562f31a0ab71dd2169af63982b6ffd3138a64dc858acd774a78b94f6c44766d208b587caaf6b7a7dd7fddbd56eb468e4a

Download Submit