hxxps://thestoneroserestaurant[.]com/

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://thestoneroserestaurant.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
4916	msedge.exe
4916	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1560	4916	msedge.exe	83
PID 4916 wrote to memory of 1560	4916	msedge.exe	83
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 4120	4916	msedge.exe	84
PID 4916 wrote to memory of 3628	4916	msedge.exe	85
PID 4916 wrote to memory of 3628	4916	msedge.exe	85
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86
PID 4916 wrote to memory of 4300	4916	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://thestoneroserestaurant.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff26d146f8,0x7fff26d14708,0x7fff26d14718
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,5838468043767667531,9997297329354796141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c924fa22ee407c8a10ca66eef05ee3bc

SHA1
307566e900bb36cc9a02a709f9ca2a3b4ec1f9cb

SHA256
55504d5884b56db509c4637a36b74461631debcc1414de67246f22f971ccdb65

SHA512
271c3e7ba14301e1b200b1f6af8fb54a69d6cc431080b8d632f74e3c50c600ce86f82da9d1d023b59c168fe5a4d56c1c182a5915e5e4d42a020345b21bf31c69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
29b406a1d52bf08d4b457d723d126c21

SHA1
6e6382119466ee1892e860b63f3f1f0fb158905a

SHA256
646b9cc5c817e6b85038ae50e7addb29d101e5862f402663a6dcb51cc1f61721

SHA512
7466a4a2a8a1f68dc6f30f9612d08e7dbdb8c5329a0fb9231eba9ebff1d58c80488c33dbe4913ec3ef39d911871f79fa9bb46978e34b64cf84a5a60244598d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a1b2874b3a2c4bf461fda45ed55e4793

SHA1
b936a84144ebe7a9b91dc59f381b05c76f366104

SHA256
9918e4684b27ad82dfec9797957767d57cba68ff8187c52e5f7864e605fbb1d9

SHA512
f39736247b8de8eab0cff04bdd09aa8c12aa853820e2e5b1b4d1f1b51c5a915db97b57071e8a1dcc05b22f78b38ceae095bb735f1f30ddab054af9f967e3904f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
048c42c53bc7c3bd3a30b2ca1a24a07b

SHA1
2548afe192b49ee4969e5d367f8721a1862f4245

SHA256
7d19c43122dc2057c7f8aae413f43ee8d5ed993ee5a4516a7dd3891b8a353786

SHA512
c5a0f8cebd23ea00ebfcba1433c9c8d57532e12d7e18776496313e56eac1bee89c380a7e40b734a21afa43298159b7f23d31c85e70d8b5c3e97c23198d7d5fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e96f3a49ce5659847a2cf4bb39176e54

SHA1
089c9e8465ddb24ab19a56c9504ac8f7198260ca

SHA256
c9c4e2ce64acef610c1c7f2b615ef0ee6ca09d8e9aae17b1821b9fa024721115

SHA512
538dc77eddb600fa5d35c08d2902c2dda07a8963d67518fba169a067a19889cdd55a86643501f57d1e9a61cce46fd5d5b42b82b8d844e90260dc8833adef342f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6452f996bb49aae206063fc812fead90

SHA1
3bdf99828874c96c21041e617d09b76e9582a9f9

SHA256
db2af21a6e977426b34fcbf6c2e11d036b94deadac7471fa2ea0fd3a7a1a39cc

SHA512
983ee63ec71838e359e4d61d9013b0abe7fe9b9fade1f3fbd59c1acb322048c54ced6d8d8e785d21f97958df5acd5d4d28dac166653878fe546215848b0c03f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f7b69a5fcee0b9c53132e53a50d319ab

SHA1
98537df86269d21516e61b09274c917350df2815

SHA256
174eb463f517e4f63794b2f7c062e49bd39ae381b532d1d261426bd719336ca0

SHA512
b0e1bcb93c34c53f7237de45ca125b3b92a6140ec41396fea2109ba02209dd5216cb914672f14f516d3a71069f0a5e0d2d8e6db3bff3d78203fa2742250640e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e01ac30784fe884ea92f91a5aaa6fad6

SHA1
1a43a48055aa40091cad5ff519a35e2be9257672

SHA256
2d765baeb34a11a838dd0f3ce6f53e72993f15bc7e4dfef39effe334182d5772

SHA512
c995d845467939dfa6d7639ac3ce120daaa7fa680abdc33b1663948084952f5169982e8cfdb1314ad80f7dd8b47af919becc0f7ca62989f55cef4e0db3fab7f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9f5a7ebef23e1588ccb37e8cd4721d77

SHA1
f59e3a0973c020f8bc2fda8ca492cdc1d6fc14b9

SHA256
51a7f921f2f5ed62b7618af6acf251f5d810878a1f3b06e4b0bf01237f8d24a8

SHA512
59fb364cab8a7ec84e873958faf31ffbd6f7d7d69d005c627079396e9f7dbf1fe166cf5ef51a99b6e2b6b5af5090166ce7e01fc404e05b7fba5ec1eaec47aa51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0ccd90e5bf11b68387bd975295ca0575

SHA1
a70e87285606962b711bbc31fc7a852090740b2e

SHA256
215d85b47832a3784f88a06a49ef5cff43852ee9862b020038dab6fd63569456

SHA512
e6bddc12d031c595080b427ce11dd6a9090a141f4629743ee10141fdecad6e3c7598900b7eb59722d9c5d3d7436029d8f8e6e8741553a20f47e95d8eeb14b3b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583cd5.TMP

Filesize
1KB

MD5
04f0f017dab8c821d3ac5b7cad8bebcd

SHA1
4526365a1cedff881954c4545fb5cc6c841231c7

SHA256
456ce24b73c544d6f01811f82d91a46c649ed0716ba4e80f233a20207696da4c

SHA512
a5790485eedbd46ef54b382e945535ac63b852c43330fb97f616d6c087e6405c30d4a3d201c95e7642e78efaab9c284dc9d3f4ee6b262bb8df56592df76da099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5eb7df24b00e91fd405f6817e87eb707

SHA1
52465e2af4b6cba72730c1be0a205771156bf934

SHA256
d34c5770180e8cb25d3b7471d3f6142c832b293dca292e0f94fcb735da07030f

SHA512
f96339f4d91784e6e5772fcdc5e8f1ced84bf35a4f5e6a239e51b6a36e0b1672b512f910bece2823ce16e68414eb16460925bd9e17b2255c985843193fb9abf6

Download Submit