203d41541c4ba4c2d296b8d78493e2c1dd0da867c339bef28486ea86d383253a

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98641f64d7ae98ef2baffd4f8afa687c.html
Size

99KB
MD5

98641f64d7ae98ef2baffd4f8afa687c
SHA1

4df144f6eabc72eadf408d07a6f33ff1d3ee9947
SHA256

203d41541c4ba4c2d296b8d78493e2c1dd0da867c339bef28486ea86d383253a
SHA512

9fc3ac3dfa40f90427b8a4650cb0a438df45053f7ebb95079443329d1e5cf8ca9dfe110d608113f270014fcccc4ffdb26ea2389988fae30dbf04f1ec9ea1a900
SSDEEP

3072:fCO7kp165RpMZscXmNRSucGIzQM9T6ULwJXE:KO7kp165RuXmNRk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
460	msedge.exe
460	msedge.exe
4348	identity_helper.exe
4348	identity_helper.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 640	460	msedge.exe	15
PID 460 wrote to memory of 640	460	msedge.exe	15
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 3188	460	msedge.exe	28
PID 460 wrote to memory of 2092	460	msedge.exe	26
PID 460 wrote to memory of 2092	460	msedge.exe	26
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27
PID 460 wrote to memory of 1952	460	msedge.exe	27

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\98641f64d7ae98ef2baffd4f8afa687c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa222446f8,0x7ffa22244708,0x7ffa22244718
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17818823519211339515,1563698825421135845,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
79369414be82e2e78979ba8463b9d58b

SHA1
9c3b99d0c41414fa3d0426a1c07637b4e2ef3bf9

SHA256
0053818d7b54ccd79a6bea602a13bca30338554e0c1ca38f41855af004a2d77c

SHA512
e1a30f33b43ad4424571cb7955ccc0863d127a27c7eb60ed1b611f7c0ff00e93377f2a83b034dce635c6b07382a34b5024a8b89039f81ee04ccccc54ffd01abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cebcbf1c0a49f0017959d28adf0cb764

SHA1
b7d95cd6d8f81ea3df372dd09c6c4a2105a22c27

SHA256
5041f2d76d831c742b89988c7236e7a1b0dc76fbd783eaa19e1bb06f0fae9527

SHA512
b01f9ea340b0ed060ec2b3785ceb006fb6f9b9278f35034d68e75d6a49031be09e411cc6a8b6952c65528a95b54a6d241d4e880b92c600c216e208c2d7f3d00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
65d6c7f754aeeaffd9b260c68d7fb715

SHA1
1169a50bfd0a3f070b3731109b0316a07d1e964f

SHA256
c3127068090dfe3372c186dfa7e0d34f8614ee5a32db1da93a7d796168c3d12d

SHA512
f9dee251318d4ce2862056550272a63b8f97842c8c78ec70c34dfe18b0f18088d7f263b62f21de24426c068d0c3765bc20d8cb22b8e4762eff2ac8ab0eeb88c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7dbf0366109121b7f32ef119271b91c6

SHA1
69fce8cd037af12c9c6fce03f497dec4be23f11d

SHA256
930fba9b9a344411b152ad3e89be1d611bfd97b6802158c4fd2384f0a079a900

SHA512
d393afa42f62014e5092479c5be2f8d2556181174b4c9484c1fad048950c26d4a55abface2e083bf13be2e00f754e64de6396c340044fdbe52ee3326cc01bd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81b78f3ab346bd98944c7597bc2f18ad

SHA1
a35fcc43f6a8b18136190b90d00a837fdc47b5bc

SHA256
764fb91e8652cfdb970ed996ddf18c111bae19f6830d9009fec3f16ed559a399

SHA512
550043de20712a9afb81911ac154e29a29186bc1c36a352c7eb499e103d206171788e668772c6457bd9ef4c2d8490e1d128c9779ebe2c6dcfc45724d5033bc44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0d8739c203e85ab5fd9b5bcd387ac22a

SHA1
ef0f5e1f56d2f67d27342d108691421fb1fab19b

SHA256
3e7d019836862ab0d221ea2befed6ee5407fb301761f156e8b003abae44af99b

SHA512
8498cc93e632b7d903ee466315b7a329b77a3f276ca3d3b34f0452fad5354d629673afebbaa7107a51b92b23357165f3349ee9d2b1fb76fb3564ad261985c08c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29c0a2ba609116d817e8aa2a3bf55bd8

SHA1
e2f611191e9cb2f2faaa84771cfcb0de4697abe4

SHA256
c07c2b96a5682f036ea0a3b78297092d618b4dad738b2c3a530afaf85d8447dc

SHA512
cc434ae6ff24f4af6bd855cb3ecc15f5611aa013eb8d030b224a602efca8853f8eb116e0b4b927def3807b5771f568d75748550b5e41f379048fda02eaba2266

Download Submit