hxxp://google[.]com

Analysis

max time kernel
241s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
1876	msedge.exe
1876	msedge.exe
760	identity_helper.exe
760	identity_helper.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4616	1876	msedge.exe	85
PID 1876 wrote to memory of 4616	1876	msedge.exe	85
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 4020	1876	msedge.exe	86
PID 1876 wrote to memory of 1832	1876	msedge.exe	87
PID 1876 wrote to memory of 1832	1876	msedge.exe	87
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88
PID 1876 wrote to memory of 2556	1876	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae81c46f8,0x7ffae81c4708,0x7ffae81c4718
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,14931994843283009657,4869732238783356376,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
1db56225cf715bb8822d536c2a5236fb

SHA1
7beb47a3827660341c617d7d4d7c0f8db0c59c04

SHA256
5a4cdea9c7c15252c12e9afabefe59886e50b9de25f40bf67e32ffe8a1e9e3d7

SHA512
6af5efd01f1fbd672318c5ccd23b2fd22dce3f7ad1053a05b0d41fbc6b789599c5ccd96e2841b9786d92fe8e1ad7b57895e62e09f0d534ac39c03ee9caac0764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6d034d0c6370637db5c8c867bbde6f18

SHA1
fd3609e16f4b6f4238f1b924d55d22bfebe14f48

SHA256
1c4997b5f78d0f7b67b921d5a7baf162895d73606987a9d3e607cbbd768282ef

SHA512
d2117a3120a989ac671236a0e35c8e754e68cc00e51980c439d3614be278a521166fe7dc9977a035f27178d7167dab3c34bbdcfc06604b72c5c72f4beb8e5bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1aa7e54e128f83d968a2bddb873747c4

SHA1
30e643cda279d2a7ebf3d76f4f991303283d653f

SHA256
eab04ea495dbfee03f91420bb0b06542dce9681ba96af7c2912957497e464de9

SHA512
b14853c499382a1914ab665a40f11392abea3be0895f5a06827217851a450e6cdb4cd895d5582639a304b65405018be1d5310bdc30315951c05f50cd72b37c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
750a3b7583e08bd3c4b1c734c4397c36

SHA1
38a7a07bfbf69e24962d2c167e21c91800460206

SHA256
161b268b8942e8b543ebb1c73fae2c265f24188fd29686e9a39a97881eb5c69f

SHA512
428fb477815825e8737ff5fe9ae1decbcf00a6b91bace08c06f37cb6870489a905a5689d38a5809b0108176819f0ed4fc17b237fb440c49ec5ef15b2c48ed053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
713de1c7db2bd1d1c92b18ec2ba14820

SHA1
3ca8cee3195eb95e9ee380650edc1536bb873dba

SHA256
0bcacdbb6c47566d16be5cdfc9c47a85b4d37cc77e04b03b44bee4d04ff7086f

SHA512
9da8b112f23ef37c9293b65bbf2060fb631e7d51e911d8dea9ad1ef848b9a08e57a9a8050c9c3dfa9604a438c14bab22d3b4007479a9d248b75186095f62715e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c26ccd0e6c5cc290677639770ec4e166

SHA1
8e3fa3a3397598a74b177059e17212d1f645fe9d

SHA256
03064743b0e6a08cc64ae6106bfea9eebdaaff848ff8e4ff9003b12bbf0d6c01

SHA512
98a7fef9c4884bb9e68a1844847046541f18a8eb5fa0ff88e256ef09301db9952a7db46bbf958f212339b3c381b6c997792bc3fd26418c5d6750bd15e527a5c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa81e82f3e2bd137129860005bea14f0

SHA1
d890e9afec0c4b54c041ae59f1726bcc7bbea271

SHA256
39534a0dbbdab96bd0e11e51f4ae966f654e9f6a770ec1db8b7ec6bb08a0950c

SHA512
843269b318a221d5133575828c8e288b8c1b73560ef3823ddf77346ec3744d2e3bcf282e4cceb36d7269f048f5813c98386b819134bcd8a4ebe0d1b6357e2401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09639d5a10046b37c3069f509b7b4101

SHA1
8441f40c506ecd277b5e5fdbe8af8d27319fe5c7

SHA256
062ae69cb66e1c4edc6ddc53d2688124887bd0dc41365e9da22ce5e259a6b508

SHA512
ff9d6b66ba73540ba3d99eb423f1665615a28e453976899f8d5c9286c0e13bea7bcd09156a4aea1f909ab9c59ee167ec0f839e9b7acfacdcf5412ff44aef44f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27597918207fbccf8ff138b1583c31f9

SHA1
42bf4a85151d9096451f50f9f3c5b1a68de28996

SHA256
74dfdf7f262e59d649673c3a1ecba528181e02b2a1522b687b74f05ecfe5043a

SHA512
7bf2cf34361b8a0e364e13ef277e82844d6d6c2cf837e15ef770e0abf81c1c5edf7bad4ff5a0bc4fa756f0e35725e59bc8c9e24d6963fc9e7aa6aa4a34f0d410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0145fa80e353bc54b0fd30c7c454b868

SHA1
08d4030bb1a737937dc1766c496d1f288a0b317a

SHA256
740c7f8a2aff7385986330330161004f23e1557b53947e80ed416b27e0118138

SHA512
7c1acdcbac4edb6e7474a64bc0c90036b0e34ba4ed5d9b957cde13f5a4336441ee3ef45b69cea923e9a4fa7b34a1dac14eda4aca6608b0d312f644a14d59622c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
5d6abe8f513dd79c81dcdf4db956507b

SHA1
207b896feed7c1ba4395cf2420185bfafdae6498

SHA256
c63f9ec86c6463a7f8510b7e2f5fa9896ab40172dd6f0d39886fd095bc11a2fb

SHA512
1a23c7269c563e0e8ac4228a8459bf72c5a13c2c2ca8e608a3acd79c7e85a7c1fb2912ccbe2f148baeb0a916d67d08e689fdf6e8f663f93c7bed67f8dae4fc29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
87d9f70be643beeb7a11246309c45bba

SHA1
fd04b3e4532131b82800dbc1cfe626c35c9ed88d

SHA256
85006808f238d480182cd132d4e62c146213e2f54d7ca35e5fb007b764e4ac4f

SHA512
820b3450df36a9871c155246d7a4156ea175a35deac9aa0a57e6362be02dcefba45b8ffc623a0c9bdebfaa5fa109136a83e4c5c8832f78af30562fdf8b6b15ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
8735a77b5eef68157df8a8eb7a2064b0

SHA1
6de4df2406492297f6d30e089e93697441630824

SHA256
8b93f01a411e7bc4fee85d7d3ac99011e69390991135286f358206a957ce6cf6

SHA512
80d200c9f2d3535c5f10fd2ad366a0f73788dfd3e00a41794cecd70882e5fcdae327d9c7a23aa16535c56de864a1f5a399256f6a976b55abd9c2eb25efa775b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585c54.TMP

Filesize
202B

MD5
1ede1e25421313b03e38dc21958264e2

SHA1
85d458d1b1523b42c23da0c18a6ed38e5349fa25

SHA256
0c12b6abd8b61ae2a7d4f852ee04f01168eeac156ba8db1677ef0b3582f6de5e

SHA512
39fbc3c3a0c5186fd10e821a69769d1fc03f0bdf40f7da0b85294e5a0c5094f85d8a388f39ea11efbde0c7e44a51c584b310cd16dc147ca9967fc019f33a1d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
24c5befe506fe551a1fef3bc6bfa78c9

SHA1
87e4a1a3f017696fb1812d11f5a657a1f47a6091

SHA256
c785b1428a288058787aa292ffe17d3c696e1a1856cebbfd6f42f04a94d785f3

SHA512
61e9f7918fe27331967fc93fe8cd9c7f92c88239801590f3a8bd1fd34251e61ab561ce9163b8be836e86e67db91dd421b54708ecf43c6d8a89b75f31bcd41e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
91d02c722e3c56d530e1026f9e480e6d

SHA1
f6b861622e1c1eba46b001c7ed234fdd528d23ea

SHA256
61d2a092ef01c7b35ac64874c52e8ea910108c106de2036e2eb0e2942257627d

SHA512
c3a6580861702abeaad6feaf981cbde45d8e4d7eff9e769b889fc5534cc9858ade820732ac29222e1a275b95e36df7f9165f3b96025f2b0c21ad37c425a91234

Download Submit