hxxps://s3[.]timeweb[.]cloud/fb44dbf9-new-york-times-news-donald-trump/iranian-agents/Donald-Trump-Assasination[.]htm#test@sk[.]com

Resubmissions

14/11/2024, 00:37

241114-ayx19avqen 10

14/11/2024, 00:30

241114-atzz2ssbrn 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s3.timeweb.cloud/fb44dbf9-new-york-times-news-donald-trump/iranian-agents/Donald-Trump-Assasination.htm#[email protected]

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
3828	msedge.exe
3828	msedge.exe
3384	identity_helper.exe
3384	identity_helper.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1488	3828	msedge.exe	83
PID 3828 wrote to memory of 1488	3828	msedge.exe	83
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 2156	3828	msedge.exe	84
PID 3828 wrote to memory of 1128	3828	msedge.exe	85
PID 3828 wrote to memory of 1128	3828	msedge.exe	85
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86
PID 3828 wrote to memory of 1624	3828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://s3.timeweb.cloud/fb44dbf9-new-york-times-news-donald-trump/iranian-agents/Donald-Trump-Assasination.htm#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3a146f8,0x7ffdd3a14708,0x7ffdd3a14718
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4112733906282434614,3945129568071487761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e721d29-0c98-4d29-ac48-5ac25f0e748a.tmp

Filesize
1KB

MD5
b3807ec4f129431d8b835507d6952978

SHA1
1ba97f5f08e5439ce08d22f3725b83b24332e7bb

SHA256
dab76dbeb24b40a9809515595254e01c2a3e4ff7a7502e0078a621726b0f4856

SHA512
99412cd52240bc105353e7f61e2ca714932cd3da857d3e9a87b283e3932fe77118d386ab54be01e1f67d04ea5cc497ee1acb7753424411a511c9a54cee4b8310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
3fd46484e89e017398a60fea3958dbe9

SHA1
61bc4bea491eb0ac5e6c11ace8c82dde1c475c60

SHA256
8c48aeed42f499460ea80381b4736fe2f0c790626052b4d23c899b2540b512c7

SHA512
575fafd5f12aba627f44d60cac67e10ae848773d905f21cfe49d47a00a7b94a65a69925de55d62a4cba6138270a67086f0d358aafecb49090e7e6ca8812616f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c24159ebfa2bac6c2767d9ca1c496769

SHA1
c42ad6dcff27266581999c5ece192c8d0d25b47e

SHA256
896085e380f80c33794773901d7e7e0d926df6de9095d25dc79fb05b7fd7e6c3

SHA512
b4a04e5f72cab1ac780bca9bb3e0202b28a93fdd81c9de12487576a6fc7615cf376803d876655b649fd1638607624ab587d57f3eeba73da45b9d968b323f2ad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
372808ea876295c0abe8b08fb58694af

SHA1
9fb47b8947fae297677c32be8a6080b40d1bfcc8

SHA256
7438953755c0c56aa647d9c5845d16e057917f9b4fda77acefcc073d561057ae

SHA512
4c83f1acef338bf3974068e2dd0ce06bf794a983ee75e42e0334e435f746197e6aac1e99b3338d353b274f484d6c0bf28e00dd42c9d1cc9b34560d6679bb8e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
804be3bed03b52823161da9b378ceaf8

SHA1
32f9253c15ad577582e97e96bc091b9c2366c7fd

SHA256
e453ee79509a465e647466b69622c25df032e6f3fa0fb00958c85422670802bb

SHA512
0b23aee71ec8aad93c0c33c862869f754e78c45ea9238ab3414ee7da1cd053c3b624654755a6e7529a86d7f88e764bc9e8a88f7baf1cc1eb2d9a97fcd7df338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
600519e47ff201f9f8ab383a6dd67ad9

SHA1
d5cbe5f9cabf9d6b6e91c2efa5ef8d1f86c26a2d

SHA256
bcb23c53e5b9462e6c4fedae0c033fdefbfadb7212b16f63bea1592306eb8856

SHA512
a5e503579535b6702f048c46de780ac3281520a04ea17d12d744a5befd6e20f6b1f8ae8c8f1af69c03e92b90b430bbd7729ef071416e49bff09400e33f3db521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c270cc4cc834040f1eaa485d77996224

SHA1
5bb6fe42d9ed50581e2fbc0950557c63ffbc1c34

SHA256
be8232c64a98406d33282743d6acda0ce596d2b7f904033121c4bc6e7692ca8d

SHA512
7e53153e559b26ec568c6e81bf154c02a5edaf6231ed021eb18a042f9c14f757f65a8c44676100c80cae4410481aaaf6ae5da5bb74bf0151c9d04bbe4ca692de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
a71716c5c2266fff63b40a13584ad495

SHA1
9b633ab8a3cd5d9ea8bd15a72dad359e832ab112

SHA256
53c8325392c0467afd6246aa4f18b6aab949882c5dfb2a765e65a55f5d259efe

SHA512
dab1e1b40c4a75d9995704808933f17c77d1a7b4b49f62b4442652864717586b368a24a468c0c0015ee8b60bb3c1f003d8ba8b515f6621af406fcc57a810d6bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5863f5.TMP

Filesize
872B

MD5
dd97658cabb583d382042a1b3fa2b0af

SHA1
9520e6237525fe5f91cc01b94819b559e10e9819

SHA256
e2b2024d755c1505f89b4bc370a0f103db3c8b8c7cc532f9e589eecfea07854f

SHA512
f8a8fe4b5ba0337d4f8d49711c883c0e5ff9e031ed3cb8ff16fe24a6515efccec7ef2f4d66509b4ee855f870f108bd4dcae0eb699e247a7a050085ff7ce65dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e44803d1ac0d65a940f1c25f8d138eb6

SHA1
d107db5198f3ac305862b2e548354b8b966784a7

SHA256
f1c186014337786b2e51ac993206a53142e052bbaef0f71f7d7029ccc33d32b1

SHA512
315966b314e8fcf2790edb4dc9d3b63321c90ff11a7d0196e1bb06aa62e6d05cdc0594f4c13cc60720508094c238013bf1a7681a130ec40176ebf8769e5157c9

Download Submit