hxxp://amiotthonunk[.]hu

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://amiotthonunk.hu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
3200	msedge.exe
3200	msedge.exe
2956	identity_helper.exe
2956	identity_helper.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 2464	3200	msedge.exe	84
PID 3200 wrote to memory of 2464	3200	msedge.exe	84
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 4244	3200	msedge.exe	85
PID 3200 wrote to memory of 1476	3200	msedge.exe	86
PID 3200 wrote to memory of 1476	3200	msedge.exe	86
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87
PID 3200 wrote to memory of 1060	3200	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://amiotthonunk.hu
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc11d46f8,0x7ffcc11d4708,0x7ffcc11d4718
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,556495129779406193,11432978352144672197,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6d51d870471e862c7ba7b259b3fcb684

SHA1
ede17dec4fb590430bb229cd79f470c0d6ecddfd

SHA256
2f121be9d12f97d112098085ffdb468895abffd43415fc437050f48523c9693d

SHA512
48c990796f7e42298630a765d0ce9079ac8a1a34f8462a2e6e703fa927dbd6e03bf2a207e35f284b22b0a379d3c4dc65306b9901fababa77668309336a4c2916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
799dede97c564a82ead76e8c7516d074

SHA1
6ce10554f8a9bead62178de23785481c002a1e8f

SHA256
0916e71475067725f58a2018d7a1a2f8b8b1007076dc8887641c1bf7ff0c4e97

SHA512
e16efaa835324b973b13e2ed194bf1f7e09c43ab046ed99a520a955978000a4a5d2034a750d8841cd1a32913b726f925d18481283bf6bfa5c63bbe89e7ae13a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ece3535cf29f8ae231a38c82423374fa

SHA1
ea8de012905e3e71dbe676cc88b1018d2e7f08de

SHA256
77eceee6474014c0cf4904a070b84bbf8c3b0a7847bac1e6b8cc9be7377e7298

SHA512
abdd18568c45533ff4aeca36161f034a573795ae765359936cd49b63502f5487d623c51a7166f126c5528e0bd1e03c7e2d3aecd2642d97bc4c62394f67173bc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e98ea02d99cfb88c117103343108601d

SHA1
a784e74485116ba5c211defa1b5674db7d91c9db

SHA256
9faaea50a912e72c9b1a5143a3fa3c742c62d4a55ae4943e572382f5da8caa7a

SHA512
f33e6a6d76c145a73537efaf6d75aea826118ffcb9f2a040905131f6bc6c03fd7a481f0104e084cb48b4f511bb164f0b10ef9fe264c875c0c6fe252c79226d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e8d312601d4bcb80ca919fd6aa5a863

SHA1
13f2b4f6f694912baf65c454e75a8e0daa19bedc

SHA256
7008659b360862fe510b40019bff8ecdfec039f08b70235581a40c05fcd55d6b

SHA512
002e953cfc3970fb385770d803a045df02fcd831d4c520e0a33c8f36b2f3984beb34cca03ec162fd3a0a5c8d360b9762db5e313637c44acc56ce236fafc0a1d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1124dfc1306e36dfa335e7151be2e690

SHA1
bcb9081a5aa725e1d2bd963bfaaba046bd742833

SHA256
4e28bec77dba488235cb12155c207140ead85f544bf37c1dfea4670de280772a

SHA512
5980f23d395ace4ab57763306ea17f64f14e297448e730f1fae7e7ff58dcbc95280b1a5b5b43a24cc775369daa4fa3203b34173ce580f2cc05956ef5f5cb8935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f78536744001dcc8ad404c8a30c2bbd

SHA1
e5d28048200e024948c0ab687e06f145bb297ada

SHA256
c8319ff47fc9f4e0c44afeec8b48a7a49a3355bf8752a41d2faca21d467ebd2c

SHA512
06c8dba6acc6dd59ab06f8df59bda71c60945f2f25987c07b71dcb15f60c4e96e157264446541fb8f447b9ee1fdf6dcfc6af004901b231ecd4851f716935ba85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
5820acfb8870f5ab78251d58464b91ac

SHA1
265a9ec6c6a8c5bf4d67df0f6e5151cbd14ecc48

SHA256
d30bc8176d43a877cd8b285ea5aae511e12b6c225064b091729430bec1cce7bb

SHA512
68eb97159dbd335315322448506e207514d0fceabe1c14919cc2c921bd233fa5f00a204ed670d11d98055d8e137786eb5cd0faacd473dc621b52ae550dd79755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
7f9275e470702c986762e0e4e4184f54

SHA1
d111182a1ed10b44fd3974a65f08a00674e18c2a

SHA256
a34742a0b90803c7f7acf778b92c384c3703f10cc7e2467f54edda880dcc9770

SHA512
0be2ade901c1e8fbfe14a2699b152090ee99634e6ee57e1f6b7a1d7ed65a0bacd745a6a7b2e0f0b69d5905d9b4631dcef4600777d63487cbc1c7353b20acf4b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
6e4a7c7382d7a6267c9630252a310999

SHA1
a71744dfb25366bba6c84fc3a3cc54ddee7e4ffc

SHA256
710a7f02504312c3cf061be2946e0a860ec0cf02571b06e40fbc8072e14e5e6d

SHA512
3f98825fb0289e9e2e99c7bd4932c0583e4fe97afe91522998cc5191de571493fc1f5633cc94b30b0ddcabd0a452935c1e41d88b0f77ab540318de6fe9b87900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5836da.TMP

Filesize
867B

MD5
171547ac14cedb934b5b282f8d81aa03

SHA1
303f858b177ab84eaa9d3b215b9e2198909b5ab6

SHA256
8f3220cf5e606e6dd7b6c763992a7b695f98bd4a50b2aa8ca1aaddec8b0f6a3a

SHA512
0079bb84260d5f46a5f0a9ff8ba82ce2fa34edf4c7322afafb92c2419b7bc1f4315adfc541bed6aef21c6491438d28183eae37cf2672456794257108e3792cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
19465c154642b5bef85f4b515c100d3a

SHA1
2ed7c053d02f8a6d2e1479591d35adb96367f851

SHA256
a090299b436cc4f08b23040d33ccedb3ca1759e93bd5cb61d6442051e442fa08

SHA512
4c23f3da1538c48204383ba6329d5c52793e26f894120eb6669e9ed10c0ebdef540613dca92dc1d9a3828438eebe98f4d301b20340758b25483cd6f23ddf8503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1f5f0afdfab740247e0f26d82fb164e

SHA1
dff2bf83e960c96bba0c5855c1b1706f3b08488b

SHA256
197da206a114a50fd358ae168aed024158d6ccb79ad169711dc3dfed1d333fad

SHA512
e9c185f23c789625d97d5193e7da83545d664e46c3e6b677157c31677c45cba286c63f074097e2e872bc2b4b5777f11834ea7259ac3aff452f12039c814c18ff

Download Submit