hxxp://xm9hr[.]mjt[.]lu/lnk/CAAABjNBnrcAAAAAAAAAAe4wOWcAAYKHTpsAAAAAAA89JwBnIjsRBXrY3HjkSmOCuqWcrGnq1wAGPIw/1/xSEhL2MHIqx7QMuJsFyy6w/aHR0cHM6Ly9teS5heXZlbnMuY29tL2ZpLWZsZWV0L3N0ZXAvcmVzZXQtcGFzc3dvcmQ

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://xm9hr.mjt.lu/lnk/CAAABjNBnrcAAAAAAAAAAe4wOWcAAYKHTpsAAAAAAA89JwBnIjsRBXrY3HjkSmOCuqWcrGnq1wAGPIw/1/xSEhL2MHIqx7QMuJsFyy6w/aHR0cHM6Ly9teS5heXZlbnMuY29tL2ZpLWZsZWV0L3N0ZXAvcmVzZXQtcGFzc3dvcmQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
4836	msedge.exe
4836	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1932	4836	msedge.exe	85
PID 4836 wrote to memory of 1932	4836	msedge.exe	85
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 1412	4836	msedge.exe	86
PID 4836 wrote to memory of 2696	4836	msedge.exe	87
PID 4836 wrote to memory of 2696	4836	msedge.exe	87
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88
PID 4836 wrote to memory of 3232	4836	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://xm9hr.mjt.lu/lnk/CAAABjNBnrcAAAAAAAAAAe4wOWcAAYKHTpsAAAAAAA89JwBnIjsRBXrY3HjkSmOCuqWcrGnq1wAGPIw/1/xSEhL2MHIqx7QMuJsFyy6w/aHR0cHM6Ly9teS5heXZlbnMuY29tL2ZpLWZsZWV0L3N0ZXAvcmVzZXQtcGFzc3dvcmQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1b3f46f8,0x7ffd1b3f4708,0x7ffd1b3f4718
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5644441141898183145,8572235518571773448,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
58e428ffa8c37fd55b975249d342faf0

SHA1
e9b4740738c559083ebe1554f074d09e597cf3a2

SHA256
974d6085abacf1cb806922482efd026256d3d64b708e5c095559c1dd62f18f56

SHA512
ddf5ff83ed1597ad84b369335a91f862380c4eacc0e2901c2e759fd96d6971baa11973ffe1189245e51ffea6f7808d4608d1ce88eb1fe70fb4aca6f65fd84731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2844e147d48d0b69af416d0bb195aa55

SHA1
76d881e55efadd8c1e1eca67c4b277fedb54f81f

SHA256
08ea643b34840007e1be966378677e21f458d90dce4436327cd5aa5f7cc42d7d

SHA512
fdc13067f61185c954f9bac5ab923ffc28456d86e19abe84c57f048cec38d9ecf8164c7f938fe6f5d91e19c123b61e5894235ac7e3bd602abfe6179a7c937f24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ff95f5771ba3e11b72fd5afd793a01e8

SHA1
fc5e5753147c9e18775487a5d9609c891018279b

SHA256
65709dca29411e4e3c9bcab98bde3bbbf7717d28bbc30ba557ab67f7f50bf0a4

SHA512
f776b1a07f3bf5653644ac428db58930eb0c4e1b878020155ee8e32c23b22556af179f2bce82e6890ea0cb2e16c88d8ab49932b1054989ebd627c76f955ee4f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe96cd972630e0939f4cafc922749d27

SHA1
f95b999c28042fe9799ca6a3b8274c5dd9c86a23

SHA256
162a2b3148e77de35bb4698a67d60107559caea47bcd3d83a996e810be2c5e6c

SHA512
28e4f78521c2e71021977c8c9ac0028d95ce99007d1ce65d520548bcc20449eb223f801d28277326f2dc9ffe558d8e318100122a8760464a164d0e1f12c6b737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfaaef056222c1619ff497356d242763

SHA1
c20b7395f859444816422abc6968ecafceaea5d7

SHA256
a0f0077182e01604cdad02391aa203be417c1887d28728791078dbbc0e980bf5

SHA512
fc3396c866b710362bd2a6525b33e38d663d9b834c558b4eee5294b8309f95d2dea256f202745d3506e3fa2de267f26fbdd10146a63a3b4586816981ebdcdc3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6a0926060cc71a2920b16467522c032

SHA1
53e8fabc58dc9cd6c520ffda91522f3e942ef380

SHA256
bce87f847ba28efa32abb2d06e6c8ab6e7850d5f675de60a43a328a10615392d

SHA512
56236c638e6ae7bd5e37c06043225d2ee479ec7e6aa4a02e73365131051b8d518150a14a62b64b6f0b4bfbc87fde1fde40a8340339e49dc1c6bd7cf8db35da9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
0549575a8cbc20d7ce50c16883220ef3

SHA1
1b253efe23730bb6be32ea5fae4ca1212ba88e0d

SHA256
6abb2ea5b301716df2aae7b26cb395d7348e3b6f27bf20ea1aee0e074b29611a

SHA512
92a2f09d4531e67d27e4e811afb4070bda536b99f2d1cf7b0b5fbacea56d2eb463a9db384a309049d27565ea476b3d94de5e13e8a108811b7857803123538624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
19cbaff32ef1c2676d6c53d37e4c81a6

SHA1
a90d44aad8296470a701d5e37aa734e14086443e

SHA256
a4e78b8a9aeefca438c4aa5b187d1bbde7cadcba017ba7fba30a6ed299d41549

SHA512
1a956814c01a13df92ea7a918aa6b49528348630c3e5f4acae079096e58b26515ba11dd8c9a31c63d5b7f621ab2b078de9ecff4f587de03b40bf50f1d4578e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bcbd26e09b509b43c2a7c5e087fc3dbe

SHA1
dde8558735d57939f16f42656fb487015ba57f6b

SHA256
5c396f018b1828f835a2ad2b6b57bb33c2e00528eb6cecc2cde67473b7996af5

SHA512
b08aa8def22c1388ca766ad1d0d24ae32ee7950abcc73874140c6ce5f2e8a0687b69e3f6dfef494c9b0a23d7efdc071a37dab20d0fda552cb65bb4bead1b2120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582edb.TMP

Filesize
705B

MD5
5c5bbca7bb9b0e76ab3d026d691a892a

SHA1
b2add31abf40898f6e26966c58a1409227b76e32

SHA256
ab15f5f042c08784c0ca722c8b8f2e7a15a7178c62a4d5187193b11a4de8d6c7

SHA512
c583ae72c502e40b465f47185328c39ff93af10074bd4e51a83b35ad129ceb548fd979fc35ead10de6d45ca0d0684a6f78afd9d7fabdc90692a935523368bfad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cc6de5965be66a30db1418b7b8d70a26

SHA1
fbd3a32dc2eb8b50fa1e5dca42d9a7e6eba94e2f

SHA256
14f074e311b737da14372c82cdb8eb8c2f08d69abcf751ade2f072b9d32a8ee5

SHA512
26cbbd4cab0cbe5df184f2b1b4d27d3ae9d4ff6a654b515f92b951ddb74b14d5af1444bb3588e2fcae341f6f1f0312c49ba38ea423a3954d649306bc920e280c

Download Submit