hxxps://ch[.]bing[.]com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=

Resubmissions

26-11-2024 11:58

241126-n488cswpdm 8

26-11-2024 11:53

26-11-2024 11:37

26-11-2024 11:30

26-11-2024 09:55

Analysis

max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-11-2024 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ch.bing.com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
1656	msedge.exe
1656	msedge.exe
220	identity_helper.exe
220	identity_helper.exe
2340	msedge.exe
2340	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1924	1656	msedge.exe	80
PID 1656 wrote to memory of 1924	1656	msedge.exe	80
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 5088	1656	msedge.exe	81
PID 1656 wrote to memory of 4980	1656	msedge.exe	82
PID 1656 wrote to memory of 4980	1656	msedge.exe	82
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83
PID 1656 wrote to memory of 2064	1656	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ch.bing.com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff87e553cb8,0x7ff87e553cc8,0x7ff87e553cd8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,12465625526679589516,14957795842001263623,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d0084f31db7945dc5fa9d60372fb84da

SHA1
7c6443484f69f96383464780866cbe8c8d975964

SHA256
41d6eed79be3b9beb0cdbe938fd9f4008f5af7fdb330299d965689c908991fac

SHA512
55459b17374094b51e27a69ff6cc6087d1e33a8dd705f7e9b1fc45adcd07bc86c952ad13e75a5feffec3a293ca9790beb7d472c35f6009bbb21bdd461a9bbb34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
02cd1e00773b6715d39ed49d14ed9c58

SHA1
ed46f2755dbd7a3b762d464d31f97daa6a1cfee0

SHA256
fa19c9f27e7194cf6e8be743611d68cc83cc1a615a16942d8eb55877f281f4b5

SHA512
183ad52733b9b0a497787a8dff4df70203df2ae72c0043544bcf31f8b9c4c4b2f648151512cf4010f16f2ca9cdde544bcc21575d24aa2b306e642d4ed5f16cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
901B

MD5
328b3c6e13ed45f3e52d7ff9b7faba64

SHA1
44197dd01f21f743bd605203f9402702210ec607

SHA256
9b580b2448c24699540a351812683ab4aef458d84470ed19e33e858188c28bc3

SHA512
0ce827940be7bce6e93c4f6484d1546403c03877b2e00461eb0a2416083a9bca7a6f589471c93e2e0296013c659cdf8ae7519f9b0d659de756c1d4f3e018f887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9d5afb045496e931edb75dbb4596e39

SHA1
efffa9289185a308a71299ae56f9f20e76b98435

SHA256
bdc915d51573a87e22fa2513f72dd78edb243f09273e084adc194e158b62c0ff

SHA512
bd0175f441bb30c6028f20f5ec2af4649b3f34379eac446e8965b41515bbd58e0794638c38fed69a0b9d665877c8b4a1f13a0afb0eaa5d97efc51ae3073102d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6ce4f9d2d1a3758c38b44e47e661bb95

SHA1
582094fce2ff487ee43c965ca97ef0452c3276f5

SHA256
ddd9ec10230d2023cb37c3c670d0728087bc7bde37582763eff319aae2c0820e

SHA512
2c8873f15e72b48dba97634d46864df48d96069f037744556a2b8bd8d7ffd93380e07d860204d34e37a894e19608c69f3861603bdc618c4cf309b8cc556a6768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80adc9cfa93946d20045f9b9fc74140c

SHA1
7eaf8140875238c9795e3a7236c1afe4cc079800

SHA256
8d30cc9aa69d8c9ec7ee5cf533c969f67c466b23d78d65184938aa7d7d9734f3

SHA512
17aba615b1f69e586fc84b6e8b33a0eee71bbe5784ba75724717f74944e71f2e15b375e3b37297a703d81b8e778d08178203953679eb46bfd298cca5b6dfed44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0326b6ea0a1d6c828c5bc6ea40d95b83

SHA1
1c0b15662ef2f0c27217154a0741e06c4a93b103

SHA256
7a570a18b092265ed41f5308d836d062da7127d37b4976df38ae01660faff00b

SHA512
0e72c07697cb6e7f40dd53739c6952f1b7985df2f4e67493a6f92792aeb59836deff000e1128e4d49b24380c324535e6549addf339c720ef8129108cc3f294c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
2955ae6c054dcb4505cca2d3d451dee0

SHA1
783556a9c9c6665cb62219aa17d74ebe5f83e3a4

SHA256
8453359c2d55690e077766e48f78c5f1641780c71abda02a3a7a697a61e81944

SHA512
daa42b07691c5d4f1f5699a70bbe90478db0138c44b6327ccc46494987b1c83d2bf93dd48fcdbc633c026d8a9b268b19b6590782728b92182f565413a54b715e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
e3c6c3660203911fe6d4fc521a3c2264

SHA1
a01bc8c602c54e98704de4afd9b085ca309f9885

SHA256
3c730080b7c3b1e3f4d0dc515be6a79d1b915c702fe1ffbd2815c863ed286d71

SHA512
06354134d1a3fea9a9b842536ef33f1300a5771d3ee15870864ef60672f6d5a23cb28185a376d6b2589e3bca16af2c3b8a89ed5a126151b84ecb8cb699537746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
8265f0172cfcfc83d50ee56031eda4f4

SHA1
e6d0b2490f1947f60d57581eb9beef85f289cd56

SHA256
7b0f39e7fb6d92a4c514bb642badafd2e0fc58573ad4b8e3dd64cc4cf7896e1f

SHA512
968f10e2af1bf46029a3eae6d36083bcb3476db9f8365f74ac999a14c362b80ec8eeb8828f8b9386447dabee72b03e8532be7d1ce606d46928b38c922a9a1f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d699.TMP

Filesize
204B

MD5
3dd37a8e31f5bd9b380e8d00b47127a5

SHA1
f2a720ab74429e138c07e54344c91841375cb74f

SHA256
134274cc351080255a2e8b537decfb6acf41b6fd094debd4863128f282a23e1e

SHA512
f5d34351573c8a545983728f4ec5a05b40c822ffd96e3b4e3db5840c8b2d0da8bf70188ab5b6e4101ca2e959724e3ff4ebb5b27cec7952293c3ee87b1b325afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
41278fe8398269fd169e48f2f2508453

SHA1
398ffd60426e10de3c032c47593b2ea857af25a9

SHA256
2b43d88bfa4ee3f3adb7b4075774bed276f064f485d0cf40fc8ddcc2b34f8ed2

SHA512
c593b1727c6704f0168e3b082bd2088c91eea2e703b287e45a9f924b10d7b54106d225f80eb63c14c0a3f7c441f5bc5f64525118b754ceefd92a3e07963c2587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63690e256169b57fb9f9892967162a8c

SHA1
f364947e96043514a09e96a291671d9ecfe3be21

SHA256
38507051945fce130fe7355000960dea7bd343da283eaf0f0f16f913a2018b10

SHA512
a7d58913ce7a3d0a8c6f271109be746aba40a02b319403616fa29cecfb931b405654d8083f94916cc3827a9f55d8a470dba82951ab4e5272c560858630afb810

Download Submit