7b08bda341a608908d2ac4437d742b20c73dc70b73bd448133718954b9230dee

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab9a57544b30b32ca500e58a08751ee3.html
Size

103KB
MD5

ab9a57544b30b32ca500e58a08751ee3
SHA1

92cffa0b8a6114eacc2c6b60f9153eb5c9a16502
SHA256

7b08bda341a608908d2ac4437d742b20c73dc70b73bd448133718954b9230dee
SHA512

4f44adfb7c2e0806eba960c5550eee63688381420257f068a7fa07454b817f974e3a8cbd0089143ea8147dc9f82c7a3bf25d7c9bf434ed00b00eb9ef738e1bd0
SSDEEP

3072:VPEijZeqLVEijZeqLczXHqegH6B1R4XGHULpcSuxw0sVAxxezS:VPEijZeqLVEijZeqLcl9

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	sites.google.com
21	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
3968	msedge.exe
3968	msedge.exe
3816	identity_helper.exe
3816	identity_helper.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2820	3968	msedge.exe	65
PID 3968 wrote to memory of 2820	3968	msedge.exe	65
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 3044	3968	msedge.exe	91
PID 3968 wrote to memory of 4880	3968	msedge.exe	90
PID 3968 wrote to memory of 4880	3968	msedge.exe	90
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92
PID 3968 wrote to memory of 2088	3968	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab9a57544b30b32ca500e58a08751ee3.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c99e46f8,0x7ff9c99e4708,0x7ff9c99e4718
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,292609372775077893,14733134015595632664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
21KB

MD5
d665d41e652d713020dccf0a25a7171a

SHA1
d3a4ac6b1f17825c105958e3590cad5e4e7e3a2c

SHA256
1af1748db5992e49dca425c2a4978e33860ac81a80ca24e08fd9a6556598f8e4

SHA512
5102ad0f2eecfbcba57acf1d51adfc08746785fc68580aefce8e04005faeafecdee4c1460ef7f62d775f8c9fe06afc41c60b768c41b5f7b0315acd45d5995d1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
44KB

MD5
15d236690ae6ed6285bc3260340703be

SHA1
3b8475145f5f25c9b6b93a260b30ada4a4279b76

SHA256
bf521348d31946bb4e6d31c338e6efa0961ee907f4f871b1e9781a849dafa792

SHA512
2eca25be9587131ba4e4e4fed86283dbab3f959299d79db056619da072788c6480e5244095de5c84a58c40bf1f5b7bc808ec94c84fd7dca99464eba4f511bbd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e3217f6d0a55a931071240bda3f8decb

SHA1
3a291258173129b7f84c153a46ffd1094b70275c

SHA256
b0021aa651ec90613720fd83a265e30c98e2045279f83bdc2143e5f46685b87c

SHA512
af24452351618d6b79e03c91dbce3ea4990c63a888e5a899ec3860a3c02c065b1655d9a7cdc5600d532bdb662a11f73425fb0193a9f31d7c97aba6c7ed9d2b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6df7233b8eb1561183d242efd0e5e68e

SHA1
f23ed199d3e67106f385e66fa9f1a76be889a8f6

SHA256
04b6659f308315d603b37919f88bfead2486beb3604bf82cf7a9da3385687695

SHA512
8744cdd2d24b229a77951b5e4793de3811a1e799f358d515f78609b7e7d9d3009cf7e6999bfc8911781db155fc6e0583ee5eef05e0f9ea5c7ec937817bbef657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a28a6116fa61302eab3134a8bd05e925

SHA1
1bbe04130e107061666667b1b2a6067a0426081b

SHA256
3aa5eba22b007f0a19e6f434b1494161bc3b5a085ba11b0b52bbced4098aa9ff

SHA512
6002c6a3a200de47a99580d55277ba228d2f0829f8cc9e4c02fcfef1db3edc3cd7f6d6250b7ad21d8a8f10aa360a9746f0f402fc966b58e7ee734e4d63c9fb71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cfbd3c938e0c69f1a653b5b6de7dac04

SHA1
2a8a747bd04f1add6e785e8ca946bf0a4fc6195b

SHA256
8c0b5ed2151a770b8541a953c8627d08bea91a046aab8024a7b0b3eb1ff0081d

SHA512
f977fd3e5a53f6237f755c09dd88f860b3cfbaa07066a0e9720d12e44da747d3f2879486e34825d794c7e4a600a12a1d0c4ef4c8c6cfd22c521a8557f39f0abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
df1c686fe1c7ac2f912a0b5dffe4dd58

SHA1
1c50c649ba168c6d3247fe70281d2e4869d51c21

SHA256
a82873125691dd759a94d18027680bf1b7573ba1805e2a12ebecaffddc4644b8

SHA512
7f67d22c06afd9692b138045199daf7530a79e9ce8fa7c249b52923acc42ad397378727683db9a1812ad7166885f02d4e8fe73c0af8fce077c26be9759aacad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e718c4ce0c6dc3f0e672f7f7a75c59b4

SHA1
482ed57067e401516ed381194fd5cf1d9cb2e328

SHA256
ebee1c4fddbe1c42e3b974a604430cbe39f48da5961ba18e02b935a52c06c705

SHA512
432928cef49db9425d06ee43b7d1b89fb05260deb31954c98c78df274c338d429b1e0997f72ff47ed359995d4679cb1d5e459dff4fcce73cd74f2477628b6aa8

Download Submit