581c27ac57897a3d5e8fc99d3eefd783aead051e050fb5dbf94e41c34976ff1d

Resubmissions

23-01-2024 16:21

240123-ttwr6scfg2 6

23-01-2024 15:37

23-01-2024 14:53

23-01-2024 14:45

23-01-2024 14:42

Analysis

max time kernel
133s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
23-01-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Claim_3456.html
Size

458KB
MD5

9e310a76299c0c8cba40a0bba76bd934
SHA1

7b1507b134ae06ca9182d23cbbd41cffe044473f
SHA256

0d7c8f449cb7261716940fd57bbe6d583aa210cb08440c66038ee83207f9c34e
SHA512

8eaffba06ed0aec2127dd47af3b5e1cc2467b4790f395b1ebf86779a46317dbb9a331d4dc7500cb8b8a50b7ba63ec79ff7aa2c68f8c5b18ff610c82cb1bb1c04
SSDEEP

12288:9UYf1Nq4RLGZtQ9g4fRqAx1GVU8Nk1XEU:JGELSQ955q8j8LU

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\Service	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000004	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\HardwareID	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000004\Service	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\HardwareID	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-894477223-740240645-3565689000-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-894477223-740240645-3565689000-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-894477223-740240645-3565689000-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-894477223-740240645-3565689000-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
3968	msedge.exe
3968	msedge.exe
2268	msedge.exe
2268	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
2008	msedge.exe
2008	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	2460	svchost.exe
Token: SeRestorePrivilege	2460	svchost.exe
Token: SeSecurityPrivilege	2460	svchost.exe
Token: SeTakeOwnershipPrivilege	2460	svchost.exe
Token: 35	2460	svchost.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 1840	3968	msedge.exe	85
PID 3968 wrote to memory of 1840	3968	msedge.exe	85
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 5076	3968	msedge.exe	86
PID 3968 wrote to memory of 568	3968	msedge.exe	87
PID 3968 wrote to memory of 568	3968	msedge.exe	87
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88
PID 3968 wrote to memory of 1192	3968	msedge.exe	88

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Claim_3456.html
1⤵
- Modifies Internet Explorer settings
PID:2820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Claim_3456.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa79843cb8,0x7ffa79843cc8,0x7ffa79843cd8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12195992602488156902,18118443643446582810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b09c5d9d170124cc803af2dd5f23e2b4

SHA1
41a3ddbafd6f3062f07ec162679bfab95fd88482

SHA256
5e6d5fcfb3805ecd4d9388837551cc02c5452f03cddba1b29b23fd02686befd8

SHA512
8fd1752211ec074f85d0ee59f39bea6e639199602d71ec947940575a9c515dda96b1eed5af10d513e21373f64a6d03146bb3251aa690830110ff4c6c486b4036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
505B

MD5
440bb523f2509655bd83cf138654742e

SHA1
cc335064a8de185ee5699ac3f77c18a76993fc39

SHA256
ef57a01a17213fba9c1014b1c3f7d07ed501263bbbb953340fce1bc73621e961

SHA512
365e786934e197ffdb7a358d3fd57d6e11fdcb0888c936d10262ea58cbbaf75a74b4b7caccae381884ef0ce2c383550fabace6ba8305d2a73327432effcb59e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
5a9fa188a28acf213b2df621e9c21fce

SHA1
e99d33f8f1656d081f3ced427dc15aeff287a003

SHA256
4d6006ce49fa029118d53ce6d0ba0bf5b87b10aa4794aa7ea50e4315aea7f2c4

SHA512
61ac469de6bef4d723eede8df23cd34e8b72a45e308a42c2514876aefecca04836ab8516b52513c8e1ce558cce0393e638344553b3c0024faf6f426f2140822b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c8f294a7abcd642d4b22f0f93b699fd5

SHA1
1d0a4c2712889dfae8f98749e1d4db40baffeb08

SHA256
218056a3268bcd51b01266294286162df7b905f7476fb871dca592ffb3d470c6

SHA512
31b528c13b5c110ede46d28294cb13c391c9b0f449058e83201505baedcd2c4c6840e6231cb791c3524db69049d9e4fde7246c93c926952883f138f103ae663c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83b6c7fb1763a0770f9835f6a9243af0

SHA1
bbb721c83bf51c4fbac8ce1fe384ec41d104b3be

SHA256
439c4e3431503cd8d389f012a3792ac96af8f4accaeaca5f0c497b5ad7b79642

SHA512
8002e7410da1f2478ef25fa68cc92a00998d6178a23d622666bcf29017f2776f1cc12b3e6a16d4ce4b8ec8b451fbc9485fc651e9e7ec7e6757d1e6e2c24f6f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c7092e044a47c593ef643da75dc6a456

SHA1
80e8bca84e362de86a7332742a62834ba887deb4

SHA256
18ac390cf8b5d7c5ceb90ce5e744deedc18be8e33c84e214bb64fbffd0686751

SHA512
b93ed015737a477a735c03e0cc884d746444d081dbb24d542ebbfbc2d30a5101799d2564733780091f28bf84adc3c7b2eadc265cb6bad6f26080abf63e0f085f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2213a52935d358d1c5ce01b88d3c8ab3

SHA1
7d06bd864b0907c78f744ba07094e863175dae78

SHA256
59ebef9655fe58e9d72a278847b4bcbb7b2cc2fb7cbf799e14f403dd241cf54c

SHA512
d4ec324e01a173efee7592cace47da0b6bff04b1f922306ebc97f908ffdb4053dbe739df84d9ba922bd39045eca1deb49939111de4ed0a22a2bcdeb5e602fca0

Download Submit
C:\Users\Admin\Downloads\61b98456-0068-41b3-b2d5-3756122657eb.zip

Filesize
166KB

MD5
ec89dc412cdd977f6e13211a2d9436f1

SHA1
af5bd84499bdd7d5114525a5270c289722cf4e0d

SHA256
81e94d9ccb2ba94b5d1c34a38c99d9c37dac349ed9f333654f27105ed3e465fe

SHA512
55c0aa58a48a5df77325d3ade72b14765a55b69e301af636901c00230f534d88e823e5a6b964fde64d4703039da4d52196984fc64b290a4a25472addef3f6eab

Download Submit