hxxps://github[.]com/SecHex/SecHex-Spoofy/releases/tag/V1[.]5[.]8-23[.]02[.]24

Resubmissions

15/09/2024, 12:28

240915-pnty6stclf 3

15/09/2024, 12:26

240915-pl731stbqf 3

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/SecHex/SecHex-Spoofy/releases/tag/V1.5.8-23.02.24

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
4532	msedge.exe
4532	msedge.exe
4040	identity_helper.exe
4040	identity_helper.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4460	4532	msedge.exe	83
PID 4532 wrote to memory of 4460	4532	msedge.exe	83
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 3752	4532	msedge.exe	84
PID 4532 wrote to memory of 2156	4532	msedge.exe	85
PID 4532 wrote to memory of 2156	4532	msedge.exe	85
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86
PID 4532 wrote to memory of 1928	4532	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/SecHex/SecHex-Spoofy/releases/tag/V1.5.8-23.02.24
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81a2946f8,0x7ff81a294708,0x7ff81a294718
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,1318308336504004188,1227007500343736247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
1.1MB

MD5
5cc9005318f4a52212d3ff0767b411f4

SHA1
70142b64ed39315a53fdd8c25fa3f2b819a6ede9

SHA256
c0ed60733e9e8a7b07411f84d8308c991c18ddaa0e3705d82d89b9b5c2595078

SHA512
b2e7ae1f5de6a08407beae497a7c7bf8d652ea2ebabe350778522d23d962b2c64ce1f7b6188b44cf187fc35bae95377e2729cb0b28ea68054de752dc571ba265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a0c93f4ddb373afff818970533ee17a6

SHA1
1ee39f48cde642c21eedddbb3556a057a437a99b

SHA256
601d10ec02c8f9b73396371e1da70759882fd1c7167617677a3b1a7e75db56a9

SHA512
83fc64a4eb90abbc6a7db77c404c6ebc057b401eddab8a246785bebb546723537325f38abe917b3465a2c5aeaec633db764f2c47e20eaf694073014d227bf2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
1b92794633aaa7d8ca83e408ef516a36

SHA1
4ae0678d6cf8abedb3e9819fc9d7d715d3f72bb6

SHA256
0ff76dc871bd6e59abe386781ef988b4c8d734bca726a4d1eb556d3d78f1e7e0

SHA512
698bb4adf1932dd48fbffb344b0053b9dc753b97a92d88a26341e0c3b0fa2e03481c5193bd2b4a1caaa2aa2f00e41eae73c53aaadc1ac6bb8be17d0f229a61bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
670eac3e216dc66e97ce581ef3428c46

SHA1
a0c1801fb0313918fd2b42483db16f875033bc90

SHA256
3934d4ce251b959863444c9cc5fbc909c68ea01fe5f50e9ae49dabd9ce8a31b6

SHA512
b26efebce71f3f198c8620446489874f2b5e0ecc4dc4d37353feec69ab5fa408ea64dc592eb689f30057806f270fcfd0e06a225db68cd86f25dc2d62a9a5dbfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b720ef8484247081120a41922fd04783

SHA1
1942b4da85ea9a247a16d872087f91a83fa36aa5

SHA256
5b47a9a3bfa85c1568c8cdf045cd1cd8512ec99cf95c2923107f2b21242ca3cf

SHA512
4eedaf78adb71e1cc3f8102fce9754f1b1af1f38c18c3274dad5358db94aead61e497456c7f3a61cf4c0808e29318f7f8fac3c92048bc40167a3bb63e3aa7d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18fa1b0bb52ba4b9b9d228f3f77a213e

SHA1
450bfa00d4adb9b5f8ac25b1ada1aba0c16b74a7

SHA256
5d3a93623cd75a0a5c41d37bafc4e22d1753c25bc74a4e8f5beb80eb0931bd1a

SHA512
2933d10f1ba54b9bf459d057e076a8c945caba9126efa425e0ab8f9c5c1d7b15466bad12b246f1a336f2345f7d7816e31ea5bcae8319b316295ef1ee0068f341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
d69c99eceaf04f4ae71749ebe215abe6

SHA1
229f89550465311e335066da1fea16eaf35a1ce3

SHA256
169f0e367aaa8cc061980313491efae0d1265a5bfa5a39ae05e04b4e66fb1ab5

SHA512
0d6fad2f428a5c049f63986386650e6924cc1a268f4ebac367c0f02950e8ad00067c2d4c088806d58160d1f498acd94100f2880484af1265f00806d07ab6f872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
4d67d2edb5c1436c276540ae5c41afca

SHA1
1620dcda6f0c7e5f4296bc49cafd130c39268e24

SHA256
0ce239c86aac2f67540d9b1e940838fed8441e83c6d822a7e2597000dd1de96e

SHA512
f52a82feece8850f55c54b20b4f95d07043943d5966da57236c443a5f7bf133e1cfd06fc7a7f9fd66641f74dffba2caad3f5cc45ca7aba09f54cd719090aab14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
64fb15d02c820fc949ff37acd684143d

SHA1
380c6667bc6ccd851c7676be4ddfeebe17a29a20

SHA256
27d83ffb04ad291eae9bcf1494f4bde91576ce441cecc5c6a2732a82dce07ea6

SHA512
51aebd1fe0be98b4028eb625cf05ffa028fafead031e9ed26776c3e03f58a24fc2a73e090f152988a95531101824ba69eba7c68ff9adb01ebe285d801269a66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582313.TMP

Filesize
874B

MD5
e6919cd7770edb06cd95a8048a0be635

SHA1
6906a6b722a92df2b0397c1ca775498f8756f0eb

SHA256
191d1dcc837ac865119f15b57b4054e859fb785a9e1c9aa350800c0e4fb907e4

SHA512
35b256b242141d4821e7c0975a7d9010f627dff8758abdab1992fae087084a5718b9237dbd1a5a1337949e901f20eb95d4ab4573088cfc0aab8d95b99562efb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d986e72bc4e6e7aebc5f6d172ced3c5

SHA1
3532303e99508f36ff86c0f435be90cf18dfe5e6

SHA256
b49649f4ac3f3c0ae9eef3caf7b3e4a17171d26910b5eb628a42048e293df77a

SHA512
2cee1d9c6bc91c73b887e8222ca3caf6f45f9da65f2cbcc071756b40f0ef36aed308ccf3377155fcb6003e457e8399be396c10eb19c73259bd7607e129563426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
83dce239d87990f5289035465a5180df

SHA1
b8374a134db6bf54bd47181ddc502075cbe4a207

SHA256
2cff0cbcc3e876593c90fe04ebd6781830244ee9bd34b110947c3ebb333c1e6c

SHA512
338315867c5d33d0eecc5b46bf427e604089819e6331a63e3f532cad4d7844ab9a142e4a13959a6bdb0291a836bfe8a0fad0102c7892c94ae8913501aa657d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6150d907e56c3c7ce82156ba6dafa1a0

SHA1
715700af23de584bd2744c899fcf4e1ebf69e913

SHA256
ed73a3b14eb5def0992959a36301c3221c32d162f4a5df32ca6c0297b07d6636

SHA512
a48b5f087756a615b2efe04e3d293ea17d6ff33ee06d72a942b39907fac302da6bf321135c8dec8fbf238b1af83e9f7de24c77900b9c74fa9919c6b22339c32d

Download Submit