hxxps://cloudflare-ipfs[.]com/ipfs/QmNqNdAc5KrmtokDJznGve9PC1DJJ6tN9WYGinZf3uKyLU?filename=84765323456789222[.]html#email@email[.]com

Analysis

max time kernel
145s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
11/12/2023, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cloudflare-ipfs.com/ipfs/QmNqNdAc5KrmtokDJznGve9PC1DJJ6tN9WYGinZf3uKyLU?filename=84765323456789222.html#[email protected]

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
1728	msedge.exe
1728	msedge.exe
3160	identity_helper.exe
3160	identity_helper.exe
4672	msedge.exe
4672	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1112	1728	msedge.exe	16
PID 1728 wrote to memory of 1112	1728	msedge.exe	16
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4320	1728	msedge.exe	82
PID 1728 wrote to memory of 4388	1728	msedge.exe	83
PID 1728 wrote to memory of 4388	1728	msedge.exe	83
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84
PID 1728 wrote to memory of 4540	1728	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloudflare-ipfs.com/ipfs/QmNqNdAc5KrmtokDJznGve9PC1DJJ6tN9WYGinZf3uKyLU?filename=84765323456789222.html#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4c1b3cb8,0x7ffb4c1b3cc8,0x7ffb4c1b3cd8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,11753641048189172024,180448122956070683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

Filesize
889B

MD5
3e455215095192e1b75d379fb187298a

SHA1
b1bc968bd4f49d622aa89a81f2150152a41d829c

SHA256
ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99

SHA512
54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8a47d7f751797745ee0edaa21769aa85

SHA1
160319607189cf22aa33fdf94bfefbd643b0fffd

SHA256
90cf1d9166705804f253aeebe36d303138ebe92c4a73d312b118a9cf4f186371

SHA512
58b32acdc208a147d529ef95f42051057b60fbcf040250df650ea42de0cba62795c827c57305c1a4a5e93d8536f00dc1cf073a6bf9a76d30f5f73545c759e90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24

Filesize
176B

MD5
c19ea7fe23699066d6fc18eb5d18a7f7

SHA1
b73a7dc1c4ee901cde68cfa28f91df6926c0c298

SHA256
d7ddde8f6330dab832bda528871ab684d5cb3ddc2c07f3bd5ceafc47a60483a8

SHA512
5856940e7f7b2894f84834ecd7d0a65845f961c5737ec808d0cabe1888ee6effc1d82b7255de00a8df131e537e3b8b7db3e69d062e9516d3d1d6304875c1440f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db2e4d9e346a898461d3dd73a9bd1489

SHA1
ed0676dbbdfb85caa47514b1ed9bd1686e2b5973

SHA256
63ec89c40c09cda645f11eed75b85d332b5898d774d56ac761f511a36216bbee

SHA512
64979cc44300f1b648c1fe78b4a272fcdfcfd3e2f2b50bc6c8a780aaa074916cd2061b45642f719a2d9790d3dee7bf159e59081eeccadca38a1a5c638efebd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
cf40559859bca35f9d2323f5ce25e827

SHA1
4724f4daecdafd387e00ccc811768df7cd72d4c3

SHA256
a5b84f90c50ef80ad2054455d4a72719338e228b596f1e0d183137a8a7bd4405

SHA512
e8d03d2a0c4d3c60969b01e0b0898e4732037cedb14bf96fc43920927504b716de89e951c8cb3818b2e7c7105c86b2aba16287190d5cb1b488d4f4edb462e6aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1b53b5e53fcc81ad15d2175ee5a14b64

SHA1
8e0fe310876c43e2abc8346a6bd1402d9507a2eb

SHA256
1873cfb0681f43bb56e35cf3f4e9f2210d9cf46593396734af6f19ec26fd3d6b

SHA512
4f39a01c9410b5d837d3d3e52b73fe2af5b6f48fb6f83eac54f55e61dde75b7c4e82e51a6d50ff583f277b921dadc34185b9849edab9a1c5d59be365136ed9ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
24285ca73dafef57cae48a20a22d214a

SHA1
0212f30d7ba4ece5e7f059ce80935e817974d3cc

SHA256
a4d933e086042a7d3de271abc519f0b85689ee15175a86c7ec8ac12d8149d29a

SHA512
e5dee962cdbf5a957664a71589f19c81baff2dbe88139ef27158f91b921bf16b72230397492e0e4f1e20b3e955c65765196ce6dd92a439954996334ebcfba787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29329837e94eab7289ce1bfb055f3ed3

SHA1
ac21c147ff381d1b9e91ca594f435b2cde2b2453

SHA256
0fa77f5837f89c534d9bd9a1905653e54dc7988730acaa0883da3aff293d8e6e

SHA512
1463334f903ca9c8e816c21ad900ad585cab18d84ef23d2a730f276d478f810dab86e717d0cdea09e9d27b0c29669a313a67b9bbebae5c7ff81017cbecff5f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c058d43c86c549232b38f4ec339e5f5f

SHA1
d5f2ccc3a00935f7dbc402fe248e62dea3ea80a6

SHA256
5279a4e706dce4b6989d95d10ca1443df59bfcf0986783f6e9685a0b003b49f7

SHA512
19dc392d1cfd9c59e3d8b58a23c28fead2c3af9341e36dc3aca0e5872f9768a368fd886f37df312cb0ff3983cea01ff200c0725062c54197439bafac070f0ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c4ee5f39c22b80cec80f0ce80abaabf

SHA1
125d23ed4a079824d181f549bafa4121da6b2eeb

SHA256
539d9b146da454539b8bcd727c75c2c33e0a656cd8998397acd3124c558871cc

SHA512
74f80d16859c3a902f48fae09c518515a6318655bafb0baebe1db1221baf12e364ce41960fbf5f035cda5dc5ecde82790b8f066e0fee1f21344e573bcf0693e3

Download Submit