hxxps://getwave[.]gg/

Analysis

max time kernel
112s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getwave.gg/

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	48	https://roxploits.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8b7c4a32fdd976f9	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
3920	msedge.exe
3920	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3668	3920	msedge.exe	84
PID 3920 wrote to memory of 3668	3920	msedge.exe	84
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 4368	3920	msedge.exe	85
PID 3920 wrote to memory of 720	3920	msedge.exe	86
PID 3920 wrote to memory of 720	3920	msedge.exe	86
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87
PID 3920 wrote to memory of 1052	3920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getwave.gg/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb12246f8,0x7ffdb1224708,0x7ffdb1224718
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10408887893298732245,5387661679514799606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
3f8c339301578c15e3c9e211bf21b6e8

SHA1
6a584876385a764c2dfd424f394d00a9dc7ae4ae

SHA256
bf2f8308b1d5b7712bc4aafb2cd646011786d35abcc9fb97410ef134d6ef37b4

SHA512
83de155e785f6f19de761f97e3427147953be643f3e5a4dd6cb50a3ddcaf80c04a7f7d51bf08246bcadf8eef63db6d895cd620a9169cdbfec63bcfe8a1f8e4fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b0db359043e8898788834ec6a73ee849

SHA1
f3021ce28fb998fe504562f4724e059593ef7e90

SHA256
eac68056906d04f8ef1868b32be12eec426262a06a5076473d718ad563a2bf1c

SHA512
cfd19fedcfd65fd6f235affa4ba04249561bb9db3e02597c4d8c0aff25b364de65cb178c80916cd40c673d304cc4c8bef6b93bc1f0e94542c08fa24e35aa9bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
0d84e8643a8f6f8adbdc7ed06450d64d

SHA1
174ffcf7cff50fecbced3bb1ede71f3a39787379

SHA256
b7efbc8264b8bb2db87e34e94b527bdf86f105a89f4e51c67d46739525f12ec4

SHA512
cef7aeb29a06cbb9ec8b5dae5cf8c2385d77d694ca0a3212862a43c440b1dca3e6fe52d2d80c7b4a8cac91c088f65df1a7609a655ef42fefcc49d37c57741909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
854B

MD5
91040f1ed8815fa2b97f98c100d268c9

SHA1
31289c123fee169f82b9ca3cc0f01a6daf8d058a

SHA256
6a1d7fed892cf2d3414adf9211126feb155c2ca71235bb4a0b9bf382a00a484e

SHA512
15c5e936ee1fa3ffd1f9b1871b937bca082c2f61437931d05c860186210facedcc65bb70f9af21e7d81d75f4e665cf79ffa3b3a32997f1d4d8b02899a695989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0db5e3730adec8fc8a78e33fd07b2839

SHA1
2e92e39974661e6f5304e71cd4d357c81b7cf26c

SHA256
77df7c668dd0a7cde8973c476f657618ec13e6c9652140fb4d6eabae7774b671

SHA512
8c1c16e4bbabc6172d40880fe5e31b0141d2917cf3b9f11557e18aaa3ec3402dde32be1924ed61b23b78ee5a18429342ba450ea901fb948defff4582d52aac80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f7ef160b4b94e292a424c0c821b8c10d

SHA1
94e7b842c68dfeef014a90ee51fcd50694da70cc

SHA256
1c8a9522a040710508de06c66c42ccd302cf3bb217f5c265d0a7c37edb260473

SHA512
cd49f3f6ec9edda77b06cc22e118ca6d902ccab2423fccfa291ea33075126eebb906f0275297ac11054e4ecee166ae5e36b229970fc9964ae7e95b486ced926d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af3f6175f9511c266eb7f32a10846f87

SHA1
d155445362fe48b783c3188824abedee3dd8e06d

SHA256
093eba11ec617c1c5375c29d3b9d2181c197c2b3c8ba71cabee68c654eb0e387

SHA512
7d9e8f71bfbe256232d813a729b32e65ece4a41f16b63dcf493d0761f8137f4974425bea8ad5b4cd54eb79d138ec9518e24343b309fbcde7268431311b70d56d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b60f523698b9e19fe2abdeb892d10dc4

SHA1
0ef11e8b96ae979fb9f2170e8c069705a31fa937

SHA256
a8c88da5d15658f8ff41d3b944e92b8f7017431c99ebf9f17a7f2ca00347ebd0

SHA512
01a75db4474271048307f5a7ed33ce8800f7ad9ee434a1d0230ced98a4cc5078306ce2b1b91e4aa3b071a25d303fd469b24fb881e510e4747839267961168c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
111e6dae29a1caceddc892ab07c7fab0

SHA1
765e7714fcf79e1d17eef9c695f923bf5f5045d4

SHA256
891fe492cc296317fe037783ee1cb7ff9322eba03d73701b6019b617b669d3cd

SHA512
8117f509ab3936fd5bf99fbf259235c8e6738bee1404189fd85a4679880690d952afdbb675e24c1bb84c0298481faaf4a6851ad22945719b0cebbe95f2e8af87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
996b3c2175df1ebeee87730d3ee64f33

SHA1
f1bfa2672793f4622aaa99e0fcd132e66f509360

SHA256
dc0097f59b95327b8d3440af35a1c13edac1337244aa7c00ded090e2bdcf5b3e

SHA512
c209b6012bfadc03f204ce69ba08a5f9e5a29a85254603590f6d6c818a10e0a7607cc71850690728333e80cec46b37674da6a081d06a291ee4038a6439277f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c484.TMP

Filesize
203B

MD5
deda4b3d04e2556f939046a61081dcae

SHA1
7cef712f5a6ffe9e2bbc19d13a11b07bd9cb1f7e

SHA256
7fd30879e0f4f6912aa74aa151cf501d894c81c14c53e058719f2acada394aa8

SHA512
a9cec162c83caebf50af0b383c1f18881306fe5f7d3a07187a4cec9da2ab5d65c83ea27db4dcf4a2d55bff827e966b6cecd682f3513ec3ee9c8a90db1a9e9585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a3749f8217f3dc52abfbd873056c853

SHA1
fe0972e716a482d8bfbf624f5220a75874113002

SHA256
0490c008c7ff380228d5148fabf2aaed3dda1797900ad1d97e24db5f12c8d9a1

SHA512
d1d813e89e56b65253fa44d6641a00ac70164e566b5aa9a8e7fdffc85dc2dde419fe1c236fee9b102e1025164464a85370ac09f024464a6977592b98ec2414cb

Download Submit