hxxps://anonym[.]ninja/download/HiC8ZKyaVFUNUTa

Analysis

max time kernel
110s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://anonym.ninja/download/HiC8ZKyaVFUNUTa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
1036	msedge.exe
1036	msedge.exe
5168	identity_helper.exe
5168	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1508	1036	msedge.exe	49
PID 1036 wrote to memory of 1508	1036	msedge.exe	49
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 1312	1036	msedge.exe	89
PID 1036 wrote to memory of 4912	1036	msedge.exe	90
PID 1036 wrote to memory of 4912	1036	msedge.exe	90
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91
PID 1036 wrote to memory of 4164	1036	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonym.ninja/download/HiC8ZKyaVFUNUTa
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea8d446f8,0x7ffea8d44708,0x7ffea8d44718
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,4844161086533068396,7978246052187511753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:5756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
fbbf8679b42a46787f53c653512bd574

SHA1
b853a3089f0c5ebd0ee14b842b934af9a2974246

SHA256
3f24201616414733f866ce56bafae3e456832ff7f5587874bc12de4fc9d5c665

SHA512
60f56b2f51e9f873aed93c33263b74b3256e4391c8bf5cacdc9e3d587b849cb11187c767d08e74bd745928d0d79f482102d5884b099c29a5172fcff719f825a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
351e579deb62742c6f13551850b32298

SHA1
56664fc510f8b2a14172de802af67e24d8580d20

SHA256
1c4412f7e099745b8ce34dd3498242ba9c48b36dada7141d0e08b9f6d7687e98

SHA512
eeef596e57f4c8cecf440a13c82538089f9141f2278496c933e363bda6274ee0b8995a9649967e16a227f4f7b0f1d6f3d63dbfb3b396e8c049bc0a44dfc541ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97701ba2ab8386b49688526fdf4d25b9

SHA1
6be4fbdbac41aa435710a3188f31e8425daedc89

SHA256
78edfbaece62e24d4aaa2a1aab7a4d7a4a1946455d857ff9dc7ee1962eece069

SHA512
78e1f91cc387f21794c6070fb31307f49e8284e883236a5ec1829b00d9fdee80ab03063933d542ff1ae14e67458c7e059a5c0b22fa2ca465f9ef728fab241724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b393ed632c21576ce00787aceb7f7540

SHA1
f7b6846d0246f6c6751e838e2334747b6c3fca2d

SHA256
cbc0d8798c0b06462b9c887a99aceba79adfc5371e9f618cba3092044d31e90c

SHA512
bcd25af4d6fd96978ee68514dddd9c23b41cf86457236cde64c1471fe2a64d17abe0fff870a2a4229cd8a7a71f3fd5a07011b61f4ebdfb8ff5b49e29e79ab189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8dafe93122da8573eef0084ac0e2711d

SHA1
2f2a19682765679259a119c652f13db49a34997b

SHA256
29c7bea80e7f1fb51f10f447c78d23d80709dd8c0fb51e33af67c884c1e7e171

SHA512
225a954bcb2f9c642e1ad082e02446596140bd7dae42e0daa93457cca5dd30a46c19ee9de5c0442e627580588723b771421e1a5614cb0e3dd3a0fd11a07d750b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4187ea246284bb584266d63ae0d635ae

SHA1
46a5a53fff34b79d39b01e73776aac728f961a49

SHA256
fdcddb2d76b1652c3d47e26aaca926de807313b112d2b6b03c5dcf84e9968f79

SHA512
adc832367d93502a51dd5813d4e6fa63174e53f04d3abc5e8fe4c00dd35cca039744c600b7db6f36491911425ab0cba3b3e247ad3e4f54bf0089e8cd8f4ef928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2597a2f7aea234f948f16fe08203f765

SHA1
64973cfffde69048dca244dc9f7ed021cc0370e7

SHA256
c19fb2e20cd4af3b79dbf6b86a7ddfb9af0b35424f02a34de0af2b3acb3fbf13

SHA512
73342b1eeb80c34ded7f12fc546e94993bd580344cb0d66f49b0f5d6056ed6d69e712df3bdcf5cca0260622a8df35a57a53c158050eb1dba573df573d0235783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9014d567daf3fdcdbd7c0cda1f513de0

SHA1
8a96cf60507e7aae04a7b7cbaa683f0cb82b423c

SHA256
4babdd0f70e8f0c8f43ffb771013668f4187e04a2c012247444d5584a073d399

SHA512
49d444b9cbe096896d0c84f42f9b581c405252a464447d0be021eebd4fc33962a2bb1a3b1d0d27543982cb1a4b2ad487698d87e0108e78b8ede601c17d12fd78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ef80197d17cbd875fd226a4adcc38c1d

SHA1
db5db5df7ee55d9b5c2d274f0baf731c9fd044cb

SHA256
db81c9d042f4e42742e01c6b608e5779bafbd1e4691ecab440c5997ad3705078

SHA512
059ac06e3cfa4d6c55cd303ed62d2af6586070d7fb6c2161c1f8da43674031057a16629d0082b092dc19a14a631d557a3d80989f38bfba50ef99ca5a09b017a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dab5de8174b23147217a5feeefa5d1f2

SHA1
fdb77e952730acbadebd6244780949f82b30061d

SHA256
d97bf2a52eda02a309fe2283454c0740f35eb5bbad832e69fc5e46c9b6ed8b6a

SHA512
86a8982d3aa5cd9e454315c3082a43973f11bf1642fc66e4ecb169b4c4eb1fdf5b427b60e49a621789f9f5f60e69fac88278f5096a29eceec529c1f15189149c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
655b4e8b716a9c5b48ad03f90e177b49

SHA1
8627aecd306e12ea1d76f9820700709825d78042

SHA256
185069eea318fb18da4cd56033f80d730a194efec1273d6a31c6784970d8936d

SHA512
4607e12eccfd8a068ab665724b456322c4361413982102ca285d4e2b76f73454b0ef9004873f5c15ad013c5b84c817f00826731d41376d0839db9512f297e613

Download Submit