ee0087a1a259c0c1e1dc9d8366a8efa7a6e68d2011fb7631991de877256cbeb2

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2396bf119c55a6c7482d489106d6285.html
Size

59KB
MD5

a2396bf119c55a6c7482d489106d6285
SHA1

e37ad611f790357344f08deb9cfc8099b079ed5f
SHA256

ee0087a1a259c0c1e1dc9d8366a8efa7a6e68d2011fb7631991de877256cbeb2
SHA512

6bb385858f6fee9e0a1ef274784a921d1772b0cc950adf8dd87b342ae9631814d0c923d42c2aa890e94ef93661cec34494aa7c10c9beb6d6a83a8026eb559cd5
SSDEEP

768:Sded9eEwhHrA+OC2aWaWS+SCyWO6amGnGj9z7ejKVKYbagvmlD9KoVCiDUYggK:jPw1rAS8zRKYbxmlRwi1/K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
1648	msedge.exe
1648	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2500	1648	msedge.exe	83
PID 1648 wrote to memory of 2500	1648	msedge.exe	83
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 4056	1648	msedge.exe	86
PID 1648 wrote to memory of 968	1648	msedge.exe	85
PID 1648 wrote to memory of 968	1648	msedge.exe	85
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87
PID 1648 wrote to memory of 4884	1648	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2396bf119c55a6c7482d489106d6285.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe46e46f8,0x7fffe46e4708,0x7fffe46e4718
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16289825741011668810,13331259896313342445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
44efdbee88f445f04f5ca4168b48b5d3

SHA1
c733e1c3326dbeb7381e7b9ebce5285f43f57366

SHA256
ba7dcab541f3a657f0fb73da2110b6948cfd34630b5b573cb19ca4fd792c6ff9

SHA512
337fa6c1770d0a1db96a48b0b48adb357977e2796e007c3d029e0033ba11d186f850550753773bab6be8f65a8321ad5bcaf8177841de7e4dd253ee56f16a3a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2c084c667a18d25261394a911c4e9af2

SHA1
233484c595c34fa995efc056890c2e25f467f0bf

SHA256
0732ce6e9a5ea39803201f6848b642fa79da34b460bf87a8adfeb882d8c396e2

SHA512
b74b31c49f0c1e02375d4ca019af0a0a43092e6a722eb4959fdfce8833f0a9cbc2481600699165975f3e1b6f6a332223fbb9935d0aa9a90c330e25be5f8b28eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51fbccf08b7971a511ce1e1c018a5504

SHA1
d22c749d10fc4dba749dad730bc12e37e5f7d339

SHA256
a941c78d6dfc3490ff3f55b5cbe3ed58d7b9a4d0481d8010b02e69d1e186af5e

SHA512
d885ce41e85e978190ea82e6947bf3b99d242a4208f1068d30136ff0864debab0596cacd071abcdb652121f18b7398b24afebaa9aeb319e138324b8ede27ae0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87f54a9454092844fa1bd1398228c0b1

SHA1
de099fbec84bf09aff3950576889d530acf27567

SHA256
44a476ba1d5ff2deede766bedd50638c63abe47e0c0aa2b9e6d4835083e5f950

SHA512
dc4dddebdb466cf9c837d6ead5b86c67df5f1fc44c8dcf3f707bd8139e176039ad792308e144abd68be99f5697c897e14b84855261d2698a0d7cc1925343e27d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4dcac6925e0b13a0ccd000184f85ab0a

SHA1
ecee4178da7e0150297bc95182b4910b456973b2

SHA256
8f52ecfcc7e7643587b090057c5f4081cc2bded821d307ea51fa22e6d8ab3342

SHA512
dd938c2a66f3bb3abb38ae2113c21248282d08f9f3f5eedb39cf7651cf8880aa35474bf85ba08bac000c884fcf55d9bddfc9e9662f1e37dc6671b48ecf2f3094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4a17e5b5eb4e7f0e4a381eca8d0f8ac

SHA1
b6c39887ca64f6025c8df83b9af5c0d45ec6d639

SHA256
9269cf43d36d7517ee7aa67361afa05d8ea94578057086ceef49595efb5bb52a

SHA512
a928d0ce3eb4efad021cd1ea473bb25edb22429785ed4ca3308993e08dfbd4ff5134833b66fd0d27770acf5b75edf13eedf516693e3bd86a2fae6c72cd435fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fe344d2124958c8dc284d05bcc7652ba

SHA1
c4efbc052b1d39a8ca7e4b41eccb9d4a8fe10c24

SHA256
df17da3003f25c5a3811f726b1ec46c17334e9a4d324764e375cc1a5830f1afa

SHA512
dd59b52cc27590ecea7fd5385b2de854eb061f30f738041c1390021e367b873a5ae7b19cfce995454cd9686f4f5487954be51e28a5bdb8c590624253c01f1772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d462.TMP

Filesize
203B

MD5
4643fea7f5bf2a45f3eb10bbe6bb01e2

SHA1
035b9450da06a25d88aefa895099d00fb946e009

SHA256
fd6615b9ed1f67656281785ebdbf8b50b5974aa3c413f1a9640b32af29ae1e92

SHA512
24256b7b505219efa51f94b6d3cbafd0c90e86921a661c278c3de74f2ccb4b2115aa705d8d27f7f591aa5c0e68ea8920086c034b9a9496543832e7d9d3347274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b63d82edecb9096474b3453871fc88e1

SHA1
cabf7f85386638c123ed6631cccc6b190095c655

SHA256
4701751434ee1739d44d98bbbcd07ac70a3d75c365da2046aa9ceb6a84657b06

SHA512
3122cdf5dcbf41b56994b41b6f149549bd3e1faf4c14851b3fb8d4f53a1db6d51f694bd7a7452a45539b0b1652322a0570eac215970ac91a8f05b8264d3fb604

Download Submit