15a66cdd3b75e7cdabbe7b7281055f6f47d5eeb7aa582ab504f9c19070e979f2

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b01d93f5a703ff012df0c0556775bd0.html
Size

24KB
MD5

9b01d93f5a703ff012df0c0556775bd0
SHA1

5eeac67a1c78192476716866ae603ee294401a51
SHA256

15a66cdd3b75e7cdabbe7b7281055f6f47d5eeb7aa582ab504f9c19070e979f2
SHA512

0d3cef55a4068328fd339795032e1c737760a6447592dee33a533632e303579ddebee2825a319f0964493578df1ecfba1543e78347103d1ab2bb8ff27d8e67c8
SSDEEP

384:ErB9u1+QMpQl338qWvv7bFdqJ3Jj/odrLRJgkA5LwaOGBr5:kB92uc3d+qJ3JLOQk44Gh5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
3204	msedge.exe
3204	msedge.exe
3616	identity_helper.exe
3616	identity_helper.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2744	3204	msedge.exe	84
PID 3204 wrote to memory of 2744	3204	msedge.exe	84
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 1748	3204	msedge.exe	86
PID 3204 wrote to memory of 2936	3204	msedge.exe	85
PID 3204 wrote to memory of 2936	3204	msedge.exe	85
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87
PID 3204 wrote to memory of 4636	3204	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9b01d93f5a703ff012df0c0556775bd0.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc9046f8,0x7ffcfc904708,0x7ffcfc904718
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11029554961127456600,13207426355227375570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c4d1a1da5158034a68d2a3a0de7ab3fe

SHA1
1c920af4b81419b668dee02705ba1025e27fb108

SHA256
7dc9a866d394a6be936352af7ef1e3f6fa7e7061f97de368c80ea01e4b552b7c

SHA512
ce852eb82a833e8b16aee077074a072ed43d7a7ceeab0d46387705f7096184d62472cfda05b9eac9c086224246639c760ec73ad86114ec8c567bb7f39d14f5bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
185668ea987cac9e7d7ba3471d8db417

SHA1
096db45ac391bfee150c475646db9247617cb881

SHA256
493240bf3889dc8befb4803a363521c88deda58a99c4ff3c2819fac3eead2053

SHA512
442c0082e5457a30e2af06be5b350ac8ff810db16445093196c615b79ba658e9a5b9fe9cc4d01d6c5a5c9a8a169e9e0f549d68314a991a767950b3ebae18465a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88623360fb7f0d58b443d856b46d89ca

SHA1
85ea15ee5f2540c66e285db91311c933f104478f

SHA256
1178ed27a2698c9083e19b46766c469dc3d125873fa511edf6c4ccf8b92747cb

SHA512
9cc295561d39686e248eeff244c43feddac260a501339e137c8be439e55de0099541656cb405964ca58bc2395daac7f8eccf710a43d9bd99e5559f57b0ab2d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2b28b85cf3a5ddb3fd322266fe36cac2

SHA1
1a5e9a4869cded3a081b712cf2c66ccc1f55e99f

SHA256
717ae9b38a460d77d5cf77b5c699a646f513da47a406f08199b1237e8a33d8cb

SHA512
68ecf04faa72e98a86de2620e815b5045b027d1396fdd57a639f802315f93416e9c597be150725401a2d728d27f870a0fe9f379ee16bfa526b6cd73d8684851c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
05a82ebb1493fcede7d7a797edb95ae1

SHA1
ad3a4e30f8c899e9de8b64503c62485bcf1c137f

SHA256
227f5bdc8deba204a566e134a288ac3161a6f61253e7d1728bba56f61aaef628

SHA512
0ff98bf163a3f6487a12b336d6d1ba102ace0ffa220f05c417e1d8e7556d9db5b914f18cde5b14179d5c019ccc19044c130b987284e2a04d23047a4d18be0a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdd8b7411a80d7733c45d1c71a83fb5a

SHA1
5ce9538502c7eafdc5daa280e9fcbe922f5843eb

SHA256
73a9ba57bea713ab57fa85908ab9230ce00982f9c2f29cd3935a2f8e2c071a77

SHA512
0380785b4d4c4f2070c650fa55de19e027b51753f36fe5fc90050f6f5a22889e74ac739f87ee85b8d84934b1bd44a2476c18515bf5c8e01b36d674b5127053dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
446961a1d6683756bff5ffbe07362c0c

SHA1
39f919e27ba8108fa5c6ab78ab946529b6506021

SHA256
b174856a9414d9e9b6bb08fc3e2bfbd23fec32084521f67af3236d7f15b77760

SHA512
2f1ab3f9effc245af6ea27607ee06e0ca43d9548f2ec8527b18ffea019526f250150553e60065d1dd27bd8dc1f81e0f49c68d0d84fab78d18662c9b2449237be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589e1f.TMP

Filesize
203B

MD5
feda576c67bd04c526dc50513e212852

SHA1
396932cbd19df0f4bda9d2fdfe5e4d843b0f8729

SHA256
0963a9b1892914bc1a27846e0a66e6a9e9976232750c87f5bd26d187fe800cd2

SHA512
9d186a4be87a1d3d1054be2cb804a544164ec9e3ea57dc5d94f2c2199c3b7c6223bfd0d55a7c9b7ae757108ef9356014452430e8efdb975684058ec53a68e333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
12a342d1769f767be614da57d0f90a9f

SHA1
690aac64ce11ce20311d5136d641bb37d1097bed

SHA256
1edae560b0f435aa291fc48811ee662822f8986a80a2b1fdbe2f7595403350c5

SHA512
e13d81a831702457c22ac3997cd0e8538a3f8023bbbc9c9fdaf425d5b07482805498493b2b996f15b4330af6a94a7baef8fe1a3855e7a35f1f66d275d854c262

Download Submit