hxxps://saasisolation[.]com/browser?token=dde9bd91-9232-4922-abcf-413f4a6b2e28&clickId&traceToken=ZGAqdQ=GO-MHw=DlG6CpHa3FlP0J_MfLiR,ZGAqdQ=GO-MHw=DlG6CpHa3FlP0J_MfLiR&url=https%3A%2F%2Fdrive[.]google[.]com%2Fopen%3Fid%3D1wjj2uN5Qdq2aUSHCbLrbnVGVtxG90wvw

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://saasisolation.com/browser?token=dde9bd91-9232-4922-abcf-413f4a6b2e28&clickId&traceToken=ZGAqdQ=GO-MHw=DlG6CpHa3FlP0J_MfLiR,ZGAqdQ=GO-MHw=DlG6CpHa3FlP0J_MfLiR&url=https%3A%2F%2Fdrive.google.com%2Fopen%3Fid%3D1wjj2uN5Qdq2aUSHCbLrbnVGVtxG90wvw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
2992	msedge.exe
2992	msedge.exe
4200	identity_helper.exe
4200	identity_helper.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3664	2992	msedge.exe	85
PID 2992 wrote to memory of 3664	2992	msedge.exe	85
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 1652	2992	msedge.exe	86
PID 2992 wrote to memory of 3176	2992	msedge.exe	87
PID 2992 wrote to memory of 3176	2992	msedge.exe	87
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88
PID 2992 wrote to memory of 1656	2992	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://saasisolation.com/browser?token=dde9bd91-9232-4922-abcf-413f4a6b2e28&clickId&traceToken=ZGAqdQ=GO-MHw=DlG6CpHa3FlP0J_MfLiR,ZGAqdQ=GO-MHw=DlG6CpHa3FlP0J_MfLiR&url=https%3A%2F%2Fdrive.google.com%2Fopen%3Fid%3D1wjj2uN5Qdq2aUSHCbLrbnVGVtxG90wvw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0aa746f8,0x7ffc0aa74708,0x7ffc0aa74718
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5273751364684829735,4530871678796490321,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x498
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
94313f5102ac21f807b3a2fd9b593961

SHA1
290e5e8c34f66c872ac5abd5869fb7b2812dc4fc

SHA256
44a2eb8124c09bf982ff6da85d22abf8914355954003133ac69d8e79c3c998cf

SHA512
697058074e538680ccc2989e2529df065dd962b730dc8633914491357e44375e14f7302424f22ed2d4bb205bf38272e937235831aaab3563f9f1e976b8f3ab23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
46c938d3788390453d01237ffde63b0e

SHA1
734ed4b498c1863fc6549465eb16f7bf584c2b61

SHA256
ffd4e32b8d0591cd824f97caf3fdbd29ff38a02ad1e43d12569ebad46ca163ec

SHA512
030ca1cc9b759d7c8c0262058d5016481f5e8da71dad8a270224560002150469537639a27eb7e3b003fe8d587b134cd482a6499339ed7f9987bafcc2ddae82d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad75f3e01c76dacc614d2efe86981ae9

SHA1
44d9c99182437b36c9eb554c842564f985cafb6f

SHA256
ac5bbd68e7b6b98bf3ebea151d2d2222321699fb610ce70b64ec413fec6f3f12

SHA512
faa3635ba1c7dd0732d7b06b66bbbf90210de1055f2ea3148a44a5287bd92a555a6b39c4ea79727c95b5370872fae4c756c3d769a1d984347a5bafee2a7c2cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1a16bf140ba6b353a5d54352f6ef2165

SHA1
ccc8cfd638dc7f07607f202650914ff985134d7f

SHA256
1f6fa0dc0b1e539ca4dfb15b8cdcd7d4a3131aecfdb4b73d288b788102e2e745

SHA512
d28b74fba6821f347b2e45f3f187124c8cfe8477331bd9535d9f77e039faba88ddf785e55350b17a6e01616168b52a72ad1f232ed1bde5aca972abe1b751e963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4fa1ffaeb2dcfb514b30072dc03799b4

SHA1
6be6b829024aa11c9ececdac18bf87cc455a82e4

SHA256
ac9bbba58634d0c6a134ecca996534a64ec0c8d5803c5dda89c2614fe558e44b

SHA512
7ab6400b0b90257066182450cd449c5a5e3f44e248759c398aeb74f79b8357e81ab8079faa897fa5e3c2f572cb7cb652d45128e208e2047eb9d21c12e5171a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9b5aa8d8727ecbdf278a0908b7f91931

SHA1
fe12ddfc3cac8d78f4528f7711d7fc66dd917f28

SHA256
b230b2bc402a9b3cdf52b53dd953a290f08b0e60364e0cceaac343a8abbf7846

SHA512
06012179447728a8727c2e2188eaaa41c4eeb3ded019009f25ee2f7b45553576bc1840ed77b89e7bbab320324e3566e33c60614f09630e8b9e2baed2ca4c8654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58196f.TMP

Filesize
2KB

MD5
9682e00ef09450c4fe2b4960b9def2ef

SHA1
5086201bb40785ebdfac9cea4e713a7a42473a57

SHA256
9efc86f195138c25df49d12ed3691a6f7875cbe8729e71a426fb2b570288bb5b

SHA512
180b141c1a9120d036554365d6e32c23e38e45d31664cdf7258882d9089a936b11141de477c7319e5f4c7adcffc29766174c9e8d1e8a1abafeb3598992fd3dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df62d6b57bda67cd5279129093ebaa41

SHA1
49c067513381c5b795a52521128396c2d868bfe6

SHA256
55c1d85232f090c350ad0d461f93440b3ad239084348f3b95ccfdd2a9a94bf85

SHA512
2b12dac311fee2c4dc882ae63150484ea22397789d3c8605c16d4cfce789cf374b1d8984fc9ddcfa9cabfb91afb6b3aa058b0a04f1f1d4a865e147d27213e1a8

Download Submit