83c723eaadfc0efdbf3770bfb7c1d9c54e41c4731e38745fc95b20990b63ad7c

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

992c6edb7bc4552caef7b87583f74836.html
Size

141KB
MD5

992c6edb7bc4552caef7b87583f74836
SHA1

bb3bfa8f473caa8cd283eebecef5dfcab1dc8455
SHA256

83c723eaadfc0efdbf3770bfb7c1d9c54e41c4731e38745fc95b20990b63ad7c
SHA512

bce7dd2003a8f2cc17097bc9c581af5baca0bd9fc5506d7bf8db5884b80f66c917c31672fdc3d7e780dac99735b11322b183096d68f90e002546660e826cff13
SSDEEP

3072:1B7sFiu7pcO8/KjgYikZI/nyGFd9BI+qHpwth:1B7sFiu7mHEEFJTqc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
3600	msedge.exe
3600	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 696	3600	msedge.exe	84
PID 3600 wrote to memory of 696	3600	msedge.exe	84
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 1652	3600	msedge.exe	85
PID 3600 wrote to memory of 4232	3600	msedge.exe	86
PID 3600 wrote to memory of 4232	3600	msedge.exe	86
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87
PID 3600 wrote to memory of 2624	3600	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\992c6edb7bc4552caef7b87583f74836.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7efe46f8,0x7ffc7efe4708,0x7ffc7efe4718
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,18115768590538793836,5375105832118905038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
91a16b26d0e2d10b477872c3a5b71fac

SHA1
d1e4309eed4900d5d3d7597d2e2da151d0d6a8ec

SHA256
2c34b34de6ff6890dbffdb6860d933588839e5bbeda7b5ed8163d555bbbc6c1b

SHA512
246d47b3aca37e805cbff8bfe822808c3524b2bf7cec52abc67cd6ddb5b6a1a30331b4e7a8b6770a8b37cb587e4dc9d6f3c594982158e4a8805601ebe9ae3863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
358068e32091faf4127bd243d5bdec7a

SHA1
93c1501156cb7bd0e1ede44563147e60a3e3ab99

SHA256
e65f721b5a5c6ce9bcbe080a64326164aa69fb5328ffba4838a3d026359b9710

SHA512
de85ffa32782922ade22b664e5b3c77eb1b3e3d5c1df598a28eee775a983c44c74e5e91cd58f29a371c24b37d56251eb34f43e0ce3e63f9e3891bb3157759945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
892685fc6b662feef93df9f10106a3a3

SHA1
bc3bab319ee32612cccb1176968f0899c3b16789

SHA256
12b5f6051f85afd4a3b6fad1aa208549fc98cecf12ff5dd7d1921664c11abe14

SHA512
ffd324c88842459603d173243372a92e57481ca26d6ded8126895f2e7df5f94db1a695e2981ccdeb6a9e0150f5652cbdb8eea5ea1d475534082036f8f38fb608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6786354ee6f37eb41b8f3a04bb92f344

SHA1
3d8cc98bbeb74d8949afcace2955ae13d5c1caef

SHA256
5562389b01c7e8f86b7df0948f0a4bd2c3946bcf23f6c7f810ab659c8143d9f5

SHA512
756d0cf34a6f1d6e48b01fb2e5c851188a196014e560fafee0bf4724b3d3aa58a27af28be07994169a965564c9c198ab17ada635170ad5eee7514cd39bafe4f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37bf2d11140673c3a50359b8f6e9bd7c

SHA1
a069e32e706f446ac6fa9cc55b340a40b582466a

SHA256
fb640933631d3a9f414911b06274f47223ae12dc8b6bea24affcf0fe62d91f5c

SHA512
9458899bbbb9b5f6bd767c97745c127ae79a09c52a118ebefb758b834ec304f25645ccffc99d914254dac9e08d6cb5cd94e169d65517d0ef45a56087581331e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78cd6784d3f958e22f204db80cf91260

SHA1
cacfe2744090dc3bbeda4c3d2b09f10c8d37c9fa

SHA256
462decdb0c16a6571e88fedf4bbf765c6baef19990c46a19398d608cc1a026d4

SHA512
2df945a42c7de7c4c9261e53a2c9eb184be7a6c8507f390326d27c263b54f28f91c00167ac94c42fe363013cbcd28f6704dbb0f8bb3deab8e7dc152ddf65886a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a6f42e4c8d7c1598174913fe6bea8d0f

SHA1
130f63f3d5af16726b7691b01efae5927057e734

SHA256
a9dc706dbac8325f49eec59878bac3c880ebd332a0402c10afdb1d23c7b3b9b4

SHA512
fa21ac8b9d37030742b7f9353f15c782925b55f587da9a9188eb727512b6c6c22925a1e6f00c4512158201cee36d64b8010c6ec5f1b95b85b18741e836448d30

Download Submit