6b62a7c6737ca0ccd4b5bc18dcc361eac5ec16abaaf384bea84c775afd08eeb6

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

77KB
MD5

b942d9b73b9c79bc8c8294770bd1e597
SHA1

b3c138a2d9e373a8095f9696f664ee3a562ea519
SHA256

3b288b9b001b4142ae0480c8636f6e90122b580c93eac02797dfac40867022c2
SHA512

ab436e02dadfa146265ba9e27ddb00047291300d0dd3f66e3d66efb07b5065990a1cbf9bf3c7100d06f8325e170ebb8c2dcf05d498e75aafe52c5c510e54ee7d
SSDEEP

1536:WgJvUrvX+nX2G0M+BhRE90WWK15UYSI+Gs/NwVK86H6QgnXy7T1et:WXFGteWRSmcFgnXy7T1et

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
5052	msedge.exe
5052	msedge.exe
2032	identity_helper.exe
2032	identity_helper.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 2388	5052	msedge.exe	83
PID 5052 wrote to memory of 2388	5052	msedge.exe	83
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 4792	5052	msedge.exe	84
PID 5052 wrote to memory of 2872	5052	msedge.exe	86
PID 5052 wrote to memory of 2872	5052	msedge.exe	86
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85
PID 5052 wrote to memory of 1844	5052	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbed9446f8,0x7ffbed944708,0x7ffbed944718
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,11173909697264518995,2879329865339612202,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x468
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8997ab56-d6d0-4ec9-8561-aa795843de5d.tmp

Filesize
5KB

MD5
497bc05051545d182eaf35c62d071715

SHA1
969a283878f3c3d5d6ec0d358f36c37c0ee99a86

SHA256
6d9542d19ab694949bdc9bb6487f0b858d549132f3b041f1e6ca27659acbcb5e

SHA512
5b384a8dbc58a46a69e981ee0295e217419d9404af00b33361801e8f601f5e2a61abad3e81c29492765ab71a848ff143d1fd10ac049fb3824d5649378464a403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
192f9b3645a631f105109eb2e22ba786

SHA1
144f8caeb6b32705686c17680fb91fee2b0ae0f4

SHA256
9bddf865a3015b827415191747b73dc832770177874a8c7a680c2f24c9b048b1

SHA512
bab08873ec360678d424ea17124626aa6535cf897ac12d280ab2fa303d206622f14b67c75b47fec0e58c8b4bfb37d6c441f512a4e8df2ea988be079f4c0a099a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3c3a1b989866bc9d04db115158b9e9f9

SHA1
4e48fc1ae4e7c38a3b35b8247de7c949e5cca42e

SHA256
7e7561a7d1c713a1b55b49c51a9d132e6e33cfc8c5a6eb696ca0b58d4588d038

SHA512
dc93a7c6bcdabadce35f846e01577a8836d0aefdaaae4d5e97940d855a423d397d336ddbe7339bddb4a0f5fd1163710e34a2afe435a3c44548065c4a75e5823e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
709c34700e636ac5d4d221371322d560

SHA1
56195e3ff28e7ba3b5e3b1d8734de2d78637ee71

SHA256
3c894e7da34b5d8083a98f1d0011584ad84dceaad246dea9b2d5c767863a4bef

SHA512
5e037c0de91f56a152e5d57823da34eb8ebb599ec43c14f565461b0c4f8b188bf3376aeb25f2c3b7275bc7c39d7ce3c3012bac05c2ae54c24fe07a7343f2f738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c4c362e2fdceb0e6f5cb5abf4a40465

SHA1
c9cff57bb5e093332a8a55e9453cc35fa7e8b5f7

SHA256
223b7b6ae03bade3d2c0af5d792a888708ab7e98e8bed0064383c345a32fe27a

SHA512
f11f652ed4b6639e626d1b816a8e103f2aab37d3046330b45814011fd870a68178b1b16509f2f91fb83edfd4886c071860acde43e44706917c7e1cd5ba3c7b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4eb98d371a654997fe80c0ad148e6426

SHA1
97bee8001bb0a40596afd9708e3aa0530de1034e

SHA256
ccbffc97d62f48ca95b79dca3ace34635446564c324285b2a5e3d7aeca6e07a4

SHA512
8ee48269ab689fc061ddb250d2e597383499a938de5eef44d550bd5443869ef62203ffead080869085c758187b7ea1e1fb101da4f322dcf0aa1e87485ffa07c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f257dd2aadf27f0cc0ce31889b518ce2

SHA1
0622cd27cfd5a9b6d92fa5e83735d72996841c84

SHA256
680bb1210f5e194fe44fd055fe9c217a037383dc803e84ebd9c226126e8d2131

SHA512
47bc02caaa4f9d5f59aad1b24b9f778a20f7e518f4685a5d7a786005e6baa497bbffa9b2812bca61894ae55da96f4969e5db8b4a73a1ff5da71a61abb9cbadc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
309807837d0913c43a302ef7f1378356

SHA1
47ea4e28b5495e245f1ef2089954c7fd74a4a732

SHA256
0334f949b8093cf197761c59932bee0ea34f17baa47db54827c3b6f0bd77743e

SHA512
84a53c1dbf23a075b3cfbe451863ecb0751a34087ef126a59b89aee246eb0a545ac5c2945b21df891ecd4e5f9a2b98ba6f6d5c33239ecdb7f11aa3fdb0b8185b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ed8c.TMP

Filesize
370B

MD5
9714d60b0ac55dec7a9ffa8d0fb07a72

SHA1
0ab5c708e2fce98a5caaea83e8caa6ac3c910e2e

SHA256
e200cefc84ae1cc55f00b1066884524c0e744d68c15c4f0228326823c616a993

SHA512
81f1951d7114b67055527e963818945828874914070b3a7efd84c27856e43b64659577521df3013cce087ec4d1fa42367a5453ff7d5f4aa2c5f84c33784908e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65845d911089fbed0c1db8027b1c8bef

SHA1
1d4ff8daa5aea06f639c03d8a5977542be0c4323

SHA256
3d16aaee8f899375cc67ebbb8ffc5cfdeadfac8a6f43e824d9892e4a8e1235bb

SHA512
33104064196e8119807386280bba3cb9eebd4a7dc8057b8b3a704268c9bc61ca43a6584a0462339e469c24a0243b5f74fb920334b92bbfabc6026892629f1912

Download Submit