ff288c3c6cb579abf196510c803eedd68ae216691c43901a8753a60745829740

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5b91f18786a8a0a265641f4f4a39fc6.html
Size

138KB
MD5

b5b91f18786a8a0a265641f4f4a39fc6
SHA1

285753e7b806552789de93ac283358c395b75884
SHA256

ff288c3c6cb579abf196510c803eedd68ae216691c43901a8753a60745829740
SHA512

2ba32867359ea3da541c4e961adc6ac3ae9ffaa70e5355344d405a64eaaed9d878ff26aa603f356b76db3726e180040f1290253ede2edd3dc106744b06630618
SSDEEP

3072:GRcVhIVs2LQegU0Dzvj40MZEPjLpUxAfYxslxNcl8CLcXmNRSxAZSlhctC3kzpRi:+cjJ/jXmNReoLtRgR8I

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4392	msedge.exe
4392	msedge.exe
5952	identity_helper.exe
5952	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1124	4392	msedge.exe	88
PID 4392 wrote to memory of 1124	4392	msedge.exe	88
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 3508	4392	msedge.exe	89
PID 4392 wrote to memory of 4136	4392	msedge.exe	90
PID 4392 wrote to memory of 4136	4392	msedge.exe	90
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91
PID 4392 wrote to memory of 1824	4392	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b5b91f18786a8a0a265641f4f4a39fc6.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef5df46f8,0x7ffef5df4708,0x7ffef5df4718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10026415259450038552,2208769610483990447,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\221ca670-dd5d-4f76-aef1-d4895f6cd3ae.tmp

Filesize
11KB

MD5
c55d72f111e79a5302ecd32b8c3b9473

SHA1
5b524af49facd29b8c1c0acb1a667ceb949e89cb

SHA256
799005255803ba15a485131e75a3fca38036b7659cf3d58d75250e3329aed174

SHA512
729526bf411e008ef8bf2d4298bee7e024d779e6c9922a87779bfb9b49e96905ae047c4d669bb67557b3eea210dfd72a4db9765d078abc97d040863d7558cf32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
d1d6e19b2659d9a70953ce39d58ad005

SHA1
c0d9a5fe8c3bbc834bcdea5eb86279c3522c13cd

SHA256
2d073e5fb28fed5638bc4b75531484fceebd7ae51d831292cf1de9e1318ae16d

SHA512
57441e87830c702e3831e0cf707daf05a63aed7a7829af39e6eeac48c04f1dd96be06a8d028f9829b9511fc23d947e17eb41f88633a5bc79ce25053d454a7c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
09ddc7e40419b7776916c9c00823aa4f

SHA1
a680991f43f8b8c2a19cd179505ccc4b064c5f64

SHA256
8833e67b3e1558fe26d5a8a39f6cc6638c57f01bb905d26cd5317280387b33e8

SHA512
996fa86c6c9e35b67feaa41d2f5ab53931e3c36edb408cfdc0f8ee3ef0c0fe567c39fc0848c21ec3ecbaf2282783eb7628db1eabcace0a0ffa490ec9523e5a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1f668e5eb0d14e9da180d1500c1127b7

SHA1
0b83becb74795f460a3d0045dd7f692d36aa051d

SHA256
5a2a77ba247120ebc6b29b86d493e1abbe1deb7044873760d740757fff279282

SHA512
4e9672e495da4fd8c9be93851102b222fa65e045d25888ecf809ab0d8865d92697d4a098cda695bf1abab0a989c264c400dab88a73033b7e5b03ffcb972b7eff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94504382f4ea8f979c6360dc16d570ee

SHA1
7a43536d9fe1aba29bd7d8044e8b38606c7699e4

SHA256
eebbc65947c41bc0cdd1aae888d1aacea25a668106713de363075179ef53ceaa

SHA512
f730640f55a04d5c20a1601928d26eb9986447dd72486e2118cf102e0fd35cb2abf18b8ff0691988ba1c4373955da9b05f5e78b93cd46f264a97332fe7fde53b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8b47f25054383d281e66d3f012e005c8

SHA1
78c499bebc76396421d0f9c75cdabeeaa2dc5135

SHA256
7d2b918760312dd30b8739dd945a2ae230d207622efd6e98379be94dd89e091f

SHA512
49a407ef8ae86d0b823919cda963f8c1fe089cf45474f9b7fc6d175ecf7ee3434d1455e6d63283627cee8c81b8376b3d983c1f8ec0e59e6695d9f66275b26db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dd6123eba457664be907ce404883f7bd

SHA1
a24feb06d6132324046665340dc649b94064d0c4

SHA256
cbcb07109b93abde7a6734fd3813b6571776df1bf7e765f2e1ad7b0041b7c3c6

SHA512
ed333304eb7dd3388cd87b1aace51f919311c8ef96912198abc9047502ee26b328c76f611aed4db40db019b03f956bb5a74c3482bf7eadcaab2430220a86bd61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit