a365968450962c94171a6857482c36585cadd96239c8b14586e5223dcf713ffd

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

973fa8b01f7142e63b158086476cfbce.html
Size

432B
MD5

973fa8b01f7142e63b158086476cfbce
SHA1

50a268378d9be368159b8d6820f3e335d720cb5e
SHA256

a365968450962c94171a6857482c36585cadd96239c8b14586e5223dcf713ffd
SHA512

a5f7f8a0ca1110a8b8d231f8ed647843b4341436b8328e4616247aeb86afc77dc9d22a88d1125de766ca6a70824f99457eca90841db149949360bbf13a612e39

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
3840	msedge.exe
3840	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3532	3840	msedge.exe	85
PID 3840 wrote to memory of 3532	3840	msedge.exe	85
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 928	3840	msedge.exe	88
PID 3840 wrote to memory of 4196	3840	msedge.exe	87
PID 3840 wrote to memory of 4196	3840	msedge.exe	87
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89
PID 3840 wrote to memory of 1568	3840	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\973fa8b01f7142e63b158086476cfbce.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8534046f8,0x7ff853404708,0x7ff853404718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16902159669741816071,10351178125121451166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
acadfc4152668fb665ce4db1bad78c51

SHA1
23262116ef383e7a61b5bb061720f09e17dce2e4

SHA256
bab5998ff6120c6e2f219d6f0aea84c0aa8d5ac497b5ed50881bc9591fbffb97

SHA512
ab943b52d2406e81d2ae54e9804620be50f520e0b9d5ebfdcb40774685bcc26a22107bcdc6172ebcbb0a1b8a24674c9d6735a000883408df33e678259d68ce0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
583B

MD5
d0f6e4ac9bc270a8fe6c3a09910e43e7

SHA1
0420d6e551148821e3fcf21ad24c7bdd0b0b651c

SHA256
d90db331e1f7d0bf6be0044a16c052f6ed37e30cbaf7acb0f38cfcf6fd1ad4d4

SHA512
0f5542095effb92a2d5494cc926db728800233f0a6e2ca7700a9a2fe48e57896a313565a6453a44d80147911871077365e60d1f347e4dd07f5825b4556d88e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
97ac30f0431a551e3ba591462d129431

SHA1
9cb175a06dd137a64f4fa5086aec14fc6c4ad86f

SHA256
dd5f2c28120d2c01cf39c38fd6a8d60cf4da6c3bd2acf9d8acc904c4a888b6bf

SHA512
4a4d9de9ebb0c3933e5bd14e4399a8dc76d7a63059855537854f8b934e56f4e72fbdc3d2dcdfbf14d0749f61af7a70e0d04f5e6495c4862e8fdff07e6cd44f57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49e7aebdaed5258286d997e996fd99ea

SHA1
face6120231c455cb5f4e4a786c39a3010c7db22

SHA256
4d9230117daad82f3cfd9c561d3f426976b6791d87146c5d7313332b811a040d

SHA512
97319563d5bf5349a13da097f1e10f802d42f88e0bfc2feb91912bd33e9ab0cb4cb5077322889da9d6f17de1939361b44687b13fc05c00f901e0a19e2178e26b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
394668ad80a2b588f7fbc8d156454b20

SHA1
25a3e74e22eb4a6574a9b0c56d6545b0b203c42e

SHA256
c8f122fe54e4b886344130a96a6bf9a1ce7fcb08468ced2eb1d7f57882b32af4

SHA512
0e92e5ada95aa87867b027f58a7414cf83712742711b27c57763dd7f4bac1bf98bb7af466b538e85bff8452ed3e5f31dc542962720b409f7e9c332e28e5c1d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579fba.TMP

Filesize
48B

MD5
9efe45fe86b3d70711aed9da715dca18

SHA1
00d181ee43f68b889076833798a30179947b5e87

SHA256
e51b0fbf43280c775c1d522cf9e055a8c6fd10f638d3e9df5349aea737876112

SHA512
eb178962ec5e697bf12d28745ae5491da854b93a7f1581bc52452bdc2382fb14a6fe88d35e0df74a9a748e4de029c400d332a21e32bee1d048290c501cefbb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
851e012dbdef820e3a38e314c97e47a5

SHA1
d0f28ffcbd85abb84183a91b9f0caae80edf0087

SHA256
d878aceaea671b66fdaabd6fc6990023a9bf22e8c4b49dd623a73a7e2ae045f5

SHA512
c2f4412c37ce807ed62bd1d04f0942320210f1a2e754ed02e2b1427acd0779f5a07cdea078e7c00bf20a6068af4643023c454d61160a4b9fd1e8c470dac63ae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f16dbaeff9c16a67f8a788fb284203a0

SHA1
98449459b9bcbda8b564e028e935f8946be06f27

SHA256
a1955812a15d43354b134b55ec34fbac508b6f629cdbf21ac9090ae1285d3538

SHA512
12162afbaea33376f05f73e28e4a883b5ae98c3c360fe1fcb33b4754bb4faf94cdf9783ab21f07be16f80d2ca014600e479b4ed7ff21285dbb5d0fa3cb94bf25

Download Submit