0e72e29f5ea9476c0ad1ae7d5f8b8ca2bf786e3717cc30445bc13d5647b207f2

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a3b469d001be4d00319ead2fa1737b5.html
Size

189KB
MD5

9a3b469d001be4d00319ead2fa1737b5
SHA1

e423567848d3014f9de14539b85b6a905064cfbb
SHA256

0e72e29f5ea9476c0ad1ae7d5f8b8ca2bf786e3717cc30445bc13d5647b207f2
SHA512

48d437a402106d4ffbfd74b851cbb10d14611727aacb8338b32e5adb8623805585e08b2bd6becc19319fe929bc6dd6d99deabc43dabaf13fd4339aacba069816
SSDEEP

3072:dF0SF3z2UP13G4k5QhLpOatVhsieW89d/fNbYaaLStRjI3bJ30cxWUu/v66sbsGA:7hr3G4k5QhL8atVGZfNbYaaLStRjWzxi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
3348	msedge.exe
3348	msedge.exe
4528	identity_helper.exe
4528	identity_helper.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 1484	3348	msedge.exe	84
PID 3348 wrote to memory of 1484	3348	msedge.exe	84
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1796	3348	msedge.exe	85
PID 3348 wrote to memory of 1832	3348	msedge.exe	86
PID 3348 wrote to memory of 1832	3348	msedge.exe	86
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87
PID 3348 wrote to memory of 4796	3348	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a3b469d001be4d00319ead2fa1737b5.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe353e46f8,0x7ffe353e4708,0x7ffe353e4718
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2119397884776500825,546264080284231790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
23KB

MD5
918e65b315d734e51f8cf25aa3a435ab

SHA1
c30f56d53120af56f2bd227fb1c36165af34b5ed

SHA256
07b1d34a14096c4a42f29f602c6a4d2b3703de803444a6be7d3d7cdfb117139f

SHA512
fb515a1bcaf8174e87ee9549c9d4ec2d2292595eae9e041002c4ac455dc8fd145cbbd78a8f54036f488d1db8ae91742320596811e134ac4b8a8fa79f50ac9096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
53da1e6e76b89806d6d18a4a01a2da23

SHA1
321d6ca55c0b90c81f717cb4f097712412441a5e

SHA256
a2c8a3a3bb45796e395112cd38af0139c8f9dd157b91e3fe6cd82954a43f4252

SHA512
d6e748b9eb5c3ed964486c4fe4c3354c16da01c60b6b3cbac3e0fea3219a9cdc1cf8d1206355cbd2252a93070e0b14c68f18845aea7e6d97c9d4b8a7980e8a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4ed27a5f2bd8390ded3ed5b164a26660

SHA1
95da6039d873c9fc77a113360288d095c503a32b

SHA256
02c05dbed4c316041af20dae59db837f0950b207f43d5081a4065a829667e4bd

SHA512
fdc74524bcd5fb94be34226df7ce0f217ef948e09034eae75311898a2c3bd65830c9d3d52ba6bc58f8a826922f0f24c289ea2ac44c31bac6969647fc5bc59550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
483dd2c39b0e7d7992d8e7115bf7756a

SHA1
5d48e28a9529c509473c5a3d4787d73ce68fe2cf

SHA256
e8db28cd4b641c85f7303a9e6a2b72c6d2db677753c9cfe5b74447532cd031ef

SHA512
244768b960f036b18da78cef7059830a4e6377720e446d98dc5cdfad4ddbecb3a1281be215a49298f93d6bae15cc33b73f88f991673070db8c18721c2604cfb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a1e72dda45e5cd63cf622fc23e0c47e5

SHA1
baf561acf116e35b410c8a0a491e1fdb59163fed

SHA256
cb7a7380cb2394b1995f9e09fe8ddf3a41ccfda7e0f3269ed1b9904e60c1bd6b

SHA512
2ea7019dd3d0990d5a0db4ab5a4585a9103d5933097fd1d92dfadb2f9b15a489727f74bd10ede070f76487835596bcc9fdcddb3f94e61c94bbe914cc5b825575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ae7af820d676e5af437089b9a3f8e053

SHA1
cf03948c5ce3df94e5ceb7b382f1a7d66a135d6d

SHA256
9345e9469c599d9ea1a36c27b25a56195ee34b6c7ed48c9b306c2d02c354aae2

SHA512
a599f654b935d6097948a25389a951f2e912c02f61162a6d5931bb0dbf3ff57788f1863df56b4cb267f3f8533e175eddf4f18758a3f66690575ab2118e868b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86d42bca9187bcef7c299174ec88b52e

SHA1
9db5ba22a84ceb5fd60c5f2460bfed5c2788f2cc

SHA256
51e7670bcba316d5cd264202cc0937ef9ba327b13ec98fb3cc9922947889d652

SHA512
93f9e6c056050fd1679bcb821036a7639fbdc032feceac98ffaaa061c2389ae5513040a3d74156e8543eb877073c1d9b04779a93caf48684f519be5d462536c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
479a352b44e28adbadfdc89ed751e26c

SHA1
cd764c8614a475b629ec2ab44c00fc25888d113f

SHA256
7c75853a466a00e55f0da27c48b81794c2422ba5cd352ee8a6b34664811c184d

SHA512
54610176a400c09e694545419d6bb6c0147fcf5105b324b3c88940783d75cd566c9b50a69ec9c6e91451365b20a557f833a7b81f432a0b6e6f891439d2dbc002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c66b71db3ca83ff6e72379df1f7f8931

SHA1
eff7156a1550bdf47665aeb44edd322caad6b282

SHA256
4866a50188ef63d849fb8d70fb44c2252da693263c0d80daa223fce2fb862289

SHA512
b6dab1146bc7d570785968b97c985be4c6388e1b26589353b6f2f8f07f1619c74589a830a5e92ddd7a9eab36c4f5987af01146a484dc3828ee497e7c4a65176c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
872510201a21e19b317a75c0fde5a6e8

SHA1
625afbc6b4dcef2ae9fbda0a3f5bd95a28126cdd

SHA256
2af11669dd6d53e3439790609192bb18948499c34eb966ed78066dd9baca88c8

SHA512
c66da4e0a186ac835c06dfe708159c4b4d14fced27d4cddca08fcb2b24e899bf427f7bde0659e1cd73a6f0661e7564c32b9cfaeb8366ecc9e72c4943a57ab821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3eef3731912415be465319c0e9548a12

SHA1
42c41ffaceb4bdf238aa78a04a37a892d1c9d4f2

SHA256
5b59a1e93f788e4e3d544c04f346f29252c731356a4e7893d75c64e4da7c5607

SHA512
5b340483e6410e02d0b6cffd54cb606b329942730a7d6e5d6d68ce5e24440f04384a5c638e667b5df1e045965561b03a3c7878383d83b3c82feb97dd1b85306d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
6b5a69e8dac00286e1ce8c556593782b

SHA1
4c8537f67619f0c38002d289f6cbd75fc9189481

SHA256
c5c8a2dfaca0424fe868e494c26fcba44c96ea8f0c1bb404aaa69bd0c9479df0

SHA512
8565cb17dca0a973958dc7e9d0741f263f402f2aa1ba2785c7852a4f86b7b8ba28d533f9c5877d4b01d9e5615179630ec3b9bd37f4b65430ea61e0a4908f9abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
81ba118c7e8c7c65645e55c0ec9c6d73

SHA1
b50b1572085aae22dfe0b1d759adf4f84f785bb6

SHA256
6ee671144ac804babb50c8cc9d2b243c03a452f329ac2b31e4a0089c5529ca11

SHA512
e5f163ade47be9ac99a67295d611aa7a3d4c43937cdee031a1d7e1b6d1ebd0588a6d1ffece2fb5310b85ef6b0689e291062a8dfeb672dd35429e0097284d9a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585975.TMP

Filesize
203B

MD5
310dc71f871f5e1c0d80385d1eb6cd97

SHA1
1379f36028369849cb2be1b8645d950de4adc402

SHA256
8c2259570f6a69a3f4967a64c7a24ff58e29f288fbc12b26483b17f9afe6c27d

SHA512
bf361c809463811ec4e23c8e0042bedd2a9737af9feb21957615204f92c01e54bf938f68b09548c389a7dc03e5e92cd55a7babc8168fa459077946bb364146e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
961f74ef0aebefbc144160dbd330a4e0

SHA1
a12329175827359ec88056791c5378bc582d2c3d

SHA256
2549d321de4b672662981fb9750879e6387f8d9ad18e647d5061b532216c8090

SHA512
e13dc2645e3907aeb6576edae3e9ed8f3c5aca3fa8d610d7664f6f4d98c27403f6f345b2ad68a79fe3fd46113d7ba47533fd8b60f02002bbac3ad09291564126

Download Submit