2c2f2d1e9cabd13f70c678f165c08bbc786dd452fb5c577f2c3820e2d6baf20d

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2ae0f1e47cb39ee79534867d727cee8.html
Size

432B
MD5

a2ae0f1e47cb39ee79534867d727cee8
SHA1

2b2f58163c7f6ee2046ea09730037fb911111e29
SHA256

2c2f2d1e9cabd13f70c678f165c08bbc786dd452fb5c577f2c3820e2d6baf20d
SHA512

f3c5c27392e61166a1f7f26fb8e4dc93ca785b4315b2c52f6294807729daf2b4dc5235ab13f6565fe821b910ec3d52b13e3a0f916ad305926b2944a2ea27de36

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
3444	msedge.exe
3444	msedge.exe
4352	identity_helper.exe
4352	identity_helper.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3792	3444	msedge.exe	44
PID 3444 wrote to memory of 3792	3444	msedge.exe	44
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 3516	3444	msedge.exe	88
PID 3444 wrote to memory of 2976	3444	msedge.exe	87
PID 3444 wrote to memory of 2976	3444	msedge.exe	87
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89
PID 3444 wrote to memory of 1980	3444	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2ae0f1e47cb39ee79534867d727cee8.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7fe246f8,0x7ffc7fe24708,0x7ffc7fe24718
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7261493540076229375,577090671922661272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58670ac03d80eb4bd1cec7ac5672d2e8

SHA1
276295d2f9e58fb0b8ef03bd9567227fb94e03f7

SHA256
76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

SHA512
99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3782686f747f4a85739b170a3898b645

SHA1
81ae1c4fd3d1fddb50b3773e66439367788c219c

SHA256
67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

SHA512
54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
738041ad0208c8ca46dc614e85cb4f0e

SHA1
6cbfff9ad15a31f36e257bf59f8462548ac9dcfc

SHA256
78ccafcff181a37aadeb4744bf7ca3db12d5d8d83bfdf08b21a132c98e80b4fa

SHA512
38c3b926c9bfbc13e7383b76fdc1ae85990f2cc920b108b5088db8a8275c690280a42308e4bb4ff91c48b17a8683f5b18b897f79daa2c717f60015c490392ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9aff5914a09f6a8708fea98c00a5537d

SHA1
b79ca0cc9a88e317c447753750ab2e282896eec1

SHA256
55feefaa77c749cd1b5a71de81efdd5cca76e5109955fca607b272bd833b9412

SHA512
72264d9669d6201d9a00ecf82ebec24ca3399cf4f78d7b810d2531fc856c563c1bfe3829fb1a5d3a479b03b9b3d422df3d684ca4b773fefbbc42bac8b6ebdb62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46bca67b273e61098dce371525740bb8

SHA1
0a940b21929a9c07ff8e1c6d15e6c406ea3d0f70

SHA256
9655ef25aff8dff4655cd430109b54d600da65ef0af08e687f69cdd0b2f65712

SHA512
919f3b7e29647116f4620eeaa54d72311e5892c4114814f3d8768fcc6468e78677bfe979e4cc164b6a8eb44556bfb9d1f9ffa00dad23202a438fdbe574118447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9935bd8436340e86ba139f7e66f03da7

SHA1
f98a8009d0ebf37b2f33da5d6a5bb2f9ac74605d

SHA256
e5ed2151d86ad0b8b5fd0ff99a8df709e86cf59e8bda98e22974fb05e4a21b28

SHA512
5c944f4a803575999ba0b211911beabb133db5ee8e04ead8b574527e0680f583693b6fdac614f96825f1545782f4238361c2a185bae5ae6e7ca88bc9e84fba58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0c774eb36faacbffdff92e25c380af3a

SHA1
9ff7a5f3e37a0dc2784be606de75c6481b549c00

SHA256
030107bef9e6fbcb48017c1836f7679991018b1b6c7ed85d8aff25830f9e1796

SHA512
63519a8f6d7420c58225be379ecb9865ef88637b6c151125195f79cfb2f078d9cdb49e24f23da5207fb63c4efccae92be68d79abadb2fe078e3703dd47df6036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ba57.TMP

Filesize
48B

MD5
ad0393c290e8a92a9fa85bdc9d8edd84

SHA1
f25983b645deed914988e179290620f26e3331d5

SHA256
781cbe7e3a7ab7130c3c187025672eee05902b140b00867d7cfeb5d856a90f0e

SHA512
81a76adfea5870263758c5395468f2721fa9e704f4dd629ef6c09996b8a19b9c5983ee19ae4c1778acdeaa3ab795519797732f5c4cb806388c7c7188a5662e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c2a2a8ede8d4d38ff3026d05fec1431b

SHA1
de48805995091495e217272d8e533921e3e7eb46

SHA256
d078c67a386c04ffcaef54f7d99ce0e9a732f7692144777a06d29ea20885bbab

SHA512
294282c9de291230a70688b4c76ce4dbe390ef44d7d1a38e94ca95a3b7650a899c50d4b095ef07e43387590d0583531e930fa16139ead0d9c5488a1de3e7d4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
53299c4f9a35315e195d7a0fdf41d6e5

SHA1
730bc6149cbef98332bcd77e305bcaf25c9829d3

SHA256
d4d07e9c54b4fe32f81994d23081934426e3aa60ca71f6becddfbb92c5235c2f

SHA512
67ce2f707a56a2c559314acd1270823cc43c189c146d0edfd2153598c2fba57a8f5b0ce79b74cbe2eddafdd75b6dfcc3c77dd0b57e60442a2c70ef61f6f068e1

Download Submit