hxxps://stackby[.]com/view/vwshr1726566317786b5506c

Resubmissions

19/09/2024, 03:25

240919-dy5b4sycme 6

19/09/2024, 03:21

240919-dwqe6sybkh 6

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://stackby.com/view/vwshr1726566317786b5506c

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	api.ipify.org
57	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1852	msedge.exe
1852	msedge.exe
776	identity_helper.exe
776	identity_helper.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5024	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 228	1852	msedge.exe	83
PID 1852 wrote to memory of 228	1852	msedge.exe	83
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 1256	1852	msedge.exe	85
PID 1852 wrote to memory of 1256	1852	msedge.exe	85
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86
PID 1852 wrote to memory of 4696	1852	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://stackby.com/view/vwshr1726566317786b5506c
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e2d446f8,0x7ff9e2d44708,0x7ff9e2d44718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5690649948815296715,13131560592088868939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b8 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
6383fd12878d817b573ca69afc8bb3a6

SHA1
06ce4adc7fddb8cec5c27214b2f3067942052a5c

SHA256
252fbc5c414f592a30e4c20bdf92405a296684633ee71d4141033037d56faa4a

SHA512
2e296ad431de3b40fc7d0ce436312f0aabef91a9de8b47f37a3e60b5bda5da045890d4cb43e38414d2c09d0face0ab3383bfbf1c6ccdc4460eb4bc8b6742e4cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
de6bca83d82d3b457aa130cc44166dfe

SHA1
ae3b59731ecedfcad13d85648a70e047cf4f5f54

SHA256
eb19cb9715a4dbb023abd436b82ccbb907405160ce17c6e47b74fc0e39939de8

SHA512
a6ba857709444d9d5536a8a17a18a19e88781083a0fba04555075dfec2c2106913c0ec48b2a1426f674bdf91da1b9a9138de9178ee6779dd0cb3c9ff7e9f5b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3f31775e07e7ac97b9a7ee46add23e9f

SHA1
0d8f3323e5893de2b6e313ed39bb7e01aa340537

SHA256
21e11980206c57ab30398ed6e6158114b85448fb9c944c19be6622b901d47cc1

SHA512
b4b81eebc0a03321b9a290377450d6fe603fd7a2b41c46afd5ef1f5d656dd91af31e8606adea8eafe32816f21b75b05c44c5c28b4d20ac323601a3e1755ac226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2879291228bad2b08cbcea48164d8615

SHA1
97643add6a4d572be58671f238d80a220b3a5232

SHA256
10d09fb7c317d3b103403ee149043788a6c42f353ce5350da2d69e974fcefe70

SHA512
f30680820b0bb4dccc4d460b3c459c0812c610c8dceebe4af8f947cb915d74990688d277a103584bdef9f809137311515aa4c1d502fed5ef593ee722a1fcf730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5af5d372b9896e5c7f2217e89a4cf30e

SHA1
68b4ab96355527b3d612787a077e46f98fe7c698

SHA256
689dd24b581b41bfe5b3ff93aa70d559e5938729199029e843d103f3fa3fef67

SHA512
6e4d3eb97204ab3269ea7e1468ac4543cb3d7d889d125f9e6087589e0773beedf82e37db3e7de162538e5c839b32561849810682f6ab0f171897822bb8c48292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1b151a3efebcceceaac2166b36b3a437

SHA1
445ddddab6bc231e7c0fea08db8344d1332b1aad

SHA256
c9f3af1e6231559d73ace76615671554df51632388ab3b81ab0776791f7e950e

SHA512
38a17042cc7f2f214f24cec6f4fad1d87621f7e8db63e47a63de3b081113f3ec2e87537a5c2d53550f781fb34f19a9b466101d07785d1a44636e909e51eb164b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7a3d1c1fcc2075c97014fda1056f660a

SHA1
50bd0110d2c22930f42941dcf07021178fc123de

SHA256
b7a6b47754c8368b700f5c46aaf4cb560ec7c1d02b43d0895af5ff950383f1ec

SHA512
10ab069ae5c3d71e13913de9dfc6ff785880b00104e9c3dbe894fe2722918babdf6f46491a19414458546662e22c6437396273b09fd87cc7902db888bf3ea57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1a1403e6bee900a67bf16232d403a36d

SHA1
fcacb3be288f33ec00afc9ee87f0022874535f24

SHA256
033010df2171b64400eb88c391636ca6cde80be64553c85c8189120a3c7220cc

SHA512
3ed9659e2984a17c49a405ef804f320ec278bd44620ab69263701d4e5605a623a432d43e0250d07493b6d64171a62f2d1c88378fc60be0124de9fde1f619599f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6bfeec296db69e228c23b5b8c0d1913f

SHA1
204dfbc5b49612a4597c2a3efd1fba5e052b070b

SHA256
e20c0d627fe82f8775df30d2f93394babc6bb9dd6ab4cab4279b8335e2fab49e

SHA512
f755515979fa6ad212ed9b0eece91a77dda8b3271cc2e3772fdd481e6d24e5e243a66f4bdf0dcec525e7b4ce074ed799673ad94862f9008efcf39b352ed06b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c40b.TMP

Filesize
1KB

MD5
f4085a3978bbabc9cb611b54a70751f9

SHA1
e9d3dde08dac30c0f6e61ba434c7f11009e139f6

SHA256
4e794a4b335da25b26e45d92f12c22e914f27520d8b6b51ee3bb49de2a1aa7ae

SHA512
1bf2cfe72ef096e4524070e2d7bf3e938c9d67716af99ce64ddf2d30f547544d0247ab7b577b2a88087d039dd49594ff2c783cb1bd356e4d209f906ac20fdc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57e9c30f329bbde8ee2a35fcd55ecba9

SHA1
3e720db54c4e16f01a6de6bf294bd4fc4ec785be

SHA256
d1ca5432fac45e6f801cc71619ae45215378c9f53edc91198564c65728390a6a

SHA512
6390f73d830535e08ec5b6f2d53f53feae60d7ad49abae3a066c82fd2273bfe70560b50a90651e4c7a9efb5601d2cc41a5037b9e3cfeccfce03b13132b49ad8b

Download Submit