dd09748e54476111dcf2c6746f80ce83d19c6e6067a4403e317ddbc9f84b4918

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac43054c155b53426cbe5bdb622d3240.html
Size

57KB
MD5

ac43054c155b53426cbe5bdb622d3240
SHA1

62d1b9d0675c0f22b88e67f60c47f5264b559adf
SHA256

dd09748e54476111dcf2c6746f80ce83d19c6e6067a4403e317ddbc9f84b4918
SHA512

d559d112eaef6e60d9cebcd6b1889ca85477c0a94864fdc961ce351231357a8dd1a513cd26f26e5663dc42f06ded7a2a23c8073f0387e1fa24a538ce0ab6f4f8
SSDEEP

1536:ijEQvK8OPHdsgjo2vgyHJv0owbd6zKD6CDK2RVrozvwpDK2RVy:ijnOPHdsD2vgyHJutDK2RVrozvwpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
4324	msedge.exe
4324	msedge.exe
116	identity_helper.exe
116	identity_helper.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2320	4324	msedge.exe	55
PID 4324 wrote to memory of 2320	4324	msedge.exe	55
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 264	4324	msedge.exe	87
PID 4324 wrote to memory of 932	4324	msedge.exe	88
PID 4324 wrote to memory of 932	4324	msedge.exe	88
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89
PID 4324 wrote to memory of 2748	4324	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ac43054c155b53426cbe5bdb622d3240.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb726f46f8,0x7ffb726f4708,0x7ffb726f4718
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17045991668242957222,11046682464838280577,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
10c6ea0c571a259942ea5fd76d139ac0

SHA1
c36b655686b74c232d59df5d74a74d1b19bd36be

SHA256
d180fb2d015310360a4aee5929aa57999ea9f0fecc2095f775cf674d2a0c47c0

SHA512
ffd4475944f8f22ce42700b78d223d3fe56579d2b4fef539e7f72d93fb3605e9d7c4ff53cf1d00993926cb9257d867a3a3a2a414d44383a8be346dc0f9f08a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ed8741caf6bc7d4dccb7260e613077fe

SHA1
ef3710ba9ab980b48111744d2773039c090b74d9

SHA256
f75f92c3ef1b827228eaca764f56027165070530ca4f0a1cd5e63b7e8cfc72a2

SHA512
26713537bd290a59e376319057ce510642c5af663d3d04c4bb3fcca0c2042e4be1b243c0b1fe94985c0ad8eb154c78b84707e8ea50a2a871666b1a3efef84f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04bce97f96f0e3be4e0e63b50def725b

SHA1
7f3b6c4b38e82d864faceb0ef8d178993ecd8752

SHA256
12494e784f05a4cb56740449ba8a2ede69356e7efb15ad8e34a2f37d442956bf

SHA512
7b2a91f57b2ce03c18f1d128e2e9beb40af3b4891a335a883bf486d5a47bc9fc044a44265a2e85d715848c4962253dd2b8a7a821bf6d49a02a45b78dad4918b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc2b851fbfffca7519985111ded48ef7

SHA1
55828471d3d0ea9066044869def12f78fc80a8ef

SHA256
2a7b27496e4c156b588756f6dfdce11ab49258155e6d4a7b76172dd978c3a979

SHA512
0146d650bf1c0e0f725b30e8b17ac7ba139579b264d7cab8e1065861d646728878498128e008f3cd92098607b37a4b111eea68d1f226c0d887ff297cde773bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d62f566bbe6b61b2a390fcf8f51abf07

SHA1
ea886862855840142c60d02f434e0eb408b72b1d

SHA256
eed8bb6c2b54e811251a40fb5ebaf2e322116305a9650bef5ec90dec0d3b1067

SHA512
02077f84a2876be47cdcbf7b2ea3b69ec7a8db5c4073e3dd1a3cd24a2224aa14db8acc7207826a099d93df1740cbb5fee028ff60e1e29db9b0468b9fa5238cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d53afdf2cca69db051ee4b15386e2660

SHA1
a64ee8422b34d6a362646de401dcd06b489c3e8c

SHA256
80101b10eda8d2cc3e5a443e3df8e4668f3d595f0a29d5584d08da33fdae24c6

SHA512
acbd0adcf7a51a4996a84b681f8df74073aa4b5e77879c3042f4ca7281c7bf67396706274e8e8a5f091481ccffdbc395dd5dda456e4ed33a9b2f5b5d3f7fb6b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f6f3.TMP

Filesize
3KB

MD5
456ba0dab12a00b9f31b99ecee64f580

SHA1
58dc255f58aa381492fac665211e9f7bce2979b3

SHA256
2162f5db170ddf907adcf8e3c432be091bab238a8b82c035798631937a60cb7a

SHA512
e698df0e2d2876439705bf24c09c3af83dd5b792fcaeb23ed1bd6455d0966b0172d74aa2818a3d441cbf272bbea172b98061e5722c3ac75c8e8d11725728256c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6fa3293179b9439871642a495d1c61d3

SHA1
e81d923a8de3138d15f96e6e417ace1e2c0fad08

SHA256
49aa95dde21ea8ac3764c09d4f8508a069d483730c6d6f030a6f53308f00e2b4

SHA512
a09df3ce5f14963e8569152885f84a654b0fcdbdfef84db96d0391013d9e7d95d11663126b5b175e213ddadb3ee5519d35e8aac618c65958ab37dd3dae1cdea7

Download Submit