913fe8fbe12f81e87cf3ea7da3479df831fa6efe244d50f2b717cd8894386df2

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a23aaad77eff1c75fdfe0ae03513aa1a.html
Size

330KB
MD5

a23aaad77eff1c75fdfe0ae03513aa1a
SHA1

34f9d241e7ed2135faaaa7c309f4f8276bd60560
SHA256

913fe8fbe12f81e87cf3ea7da3479df831fa6efe244d50f2b717cd8894386df2
SHA512

b6ee4e41b2ef893352cfdcbbc4032e583650b9acc90fc6c3518fdb8d3fea8c473a95bc947314075a5c0ce159509035405f7b02c836fa2bd2afb53b199a26ae7b
SSDEEP

6144:RHHW1+a+/z9VxLY7iAVLTBQJlT+hB9FRkhH:RW1+a+L9nLYWAVZQv+hB9FRkhH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
360	msedge.exe
360	msedge.exe
4660	msedge.exe
4660	msedge.exe
1660	identity_helper.exe
1660	identity_helper.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1700	4660	msedge.exe	83
PID 4660 wrote to memory of 1700	4660	msedge.exe	83
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 2196	4660	msedge.exe	86
PID 4660 wrote to memory of 360	4660	msedge.exe	87
PID 4660 wrote to memory of 360	4660	msedge.exe	87
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88
PID 4660 wrote to memory of 1424	4660	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a23aaad77eff1c75fdfe0ae03513aa1a.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc825246f8,0x7ffc82524708,0x7ffc82524718
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14370577737906196471,2317935327219778385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
14734a8bb0bbf70e4c2baa3d73adc7ec

SHA1
b3a16d617c95fd8da1af3215867abdd80a23a708

SHA256
56ad32c2be9235dfe4a5653351f1121c4373fb48147d91bbb9397b65d5bf0bb5

SHA512
aaed10d4b91749bda93e69b4188c93d4fc89cc9e05b4ea5bdd8363cea53a3d1904f0080f23826edf35f18fe4bdd51a86c04a5a43b7e5f5aaf1568ed17e3a0d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8db7552d9eda2c70556e4ff6caeaa4dc

SHA1
6c27cbe5d0739cd37b96c1bdcfda0c82abf311ae

SHA256
e7faadc9eb06e202c9606a3fe674781aa5604e677e4ea1349fbcc3a429f1cb2c

SHA512
2b44cc54cde58fbc3b1be765f9341c06fc9ed4500548a798c78e267e1e9a4b440d7e80b7d66cdcde814a917c3af85a3aa77e3bef0c09e33976784366c817ea17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
1c3f721d83738ba90ff4c0c8debf06c5

SHA1
0f0833b4e02891a8697d116a1f69418c98bb6e60

SHA256
14453b7d89f7d3c526176372df0816654eebf4bcf64c214c56e9b1587daf3efa

SHA512
858ebc6f3db47c5cc09072352863631b651c96df623cfb39c88be07ed49943ff7a893e3b8007da79555a4330cc4d7ea863a56f2e2e5fdfc64fe65bce507272e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1578e55dd6eedb4f3e9e448888121145

SHA1
efae9fbc6ad4e720aee64901e556f9e9d1e022f4

SHA256
8bc537fbae3dd78d9246335798508539e12f75c1ab7a973b160f3de2d87c5308

SHA512
58b2ae255a816c4f1a93825da5b8dbed71701d4559465a74fb69b854d782dcc864a9b07190e2a1f990860012292f0759334e1a6a97bdbaa558d410ed9e8ffeb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8198779df8b341930c1b56cbe0f859d4

SHA1
db23d9ed20bbe2810d97f5debe6d6784501dba66

SHA256
f7554975a728cd8b1a9aa046632f8739ccfccdc405b2386e10dc023985d0642c

SHA512
adc632347190075f88ee485627c7e76d05d857d62c22e7f87fbafbd5ea7b85c9cb2c913de8223ae618628d2e4b624d77f798c9efab2dc93151b798becf87c5c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
54ecf5e750cc5579c8dc56b8427b501e

SHA1
b6fc18ef54809b01676ccdc9d8efa5b9224fe001

SHA256
a9bb1df968c2b79f7212d9bc24412d8af819fcd8b74f019fc1c3e908675c8749

SHA512
fb38db48ad7ddb7fb969c315b798c38941a463441a806bf4635b322305fdb41310c0a8b7bea69a175c267269c730a7a96b30dcb1c64f008f19fe2a44c9da53c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fccef8ed9a82ac48a1c0aeddc2636c6d

SHA1
b2944f2cb32e3dda1d6611d041736df4ec6a7393

SHA256
48b8db7299a990fd3c79d774410b7c047d4f9d1245eeeb191765640b4e3de355

SHA512
88e7e7d29ac2a1f45f21f215980af5a04368dcb4a15d87d5c5e7793c24577df7ea8d6a92978680de1ec16262474e90ad09a27426ceb1d382fcc624812a9e75b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ab422bb7d1d98a44c1e7bcbdb25f363

SHA1
d96530c69a1a1b0c3b14d5596f79f0b3330fdc49

SHA256
1079f0675346d7777d8c1be95a46ed458cb67ba4fc3cb32355bd961550ff3b2b

SHA512
7a619809754d26587d833cd5143fa6079928cfbb092ba1acf43e25a86782acc5fe43da31b8fd9d32f98311d231cd022cf981fcc9e6d356384a7e4c8f1615455d

Download Submit