11d9d265ea091cb12f75c52869cc9a354203f3060f880a2c31728683ab933a28

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b725ee1451eda6c5b463c93ffb178fd9.html
Size

432B
MD5

b725ee1451eda6c5b463c93ffb178fd9
SHA1

8b9f715cc0965f0784ba89365e5a629dd4d67e13
SHA256

11d9d265ea091cb12f75c52869cc9a354203f3060f880a2c31728683ab933a28
SHA512

5806dc95ff359a21ade218d14e856dcdeb974d0790872ee5dcf32cbcdf3b273cf2f2209616f285f9e4b1d1f2aa9d0eefecce1bcab6581cb873c3e0dcab334427

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
4984	msedge.exe
4984	msedge.exe
3964	identity_helper.exe
3964	identity_helper.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2616	4984	msedge.exe	88
PID 4984 wrote to memory of 2616	4984	msedge.exe	88
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 3616	4984	msedge.exe	90
PID 4984 wrote to memory of 3616	4984	msedge.exe	90
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b725ee1451eda6c5b463c93ffb178fd9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffae68d46f8,0x7ffae68d4708,0x7ffae68d4718
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
4679a9a0d72aa2e8238a2c863e0ef7b4

SHA1
3b29500089fb87ca60fc0a855a40a6a6ba2b1688

SHA256
a124fe2a9055110214d3ac05be2453ca5f068f584ad1f8ca4f6f7c7e6dcd488c

SHA512
ccb0fb98145e47ead1b11313a93ea8806ec7918eb40a9ce933c0e5608e756e36c5aa2e0193fe50df79ae708306ab8a78b6b187301a8a9f93dbf8acda228d75fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c7444606162e25c474662bec37de4dfe

SHA1
1dd4618a07dd2ab28f6d2ef28b6e3fc73608d861

SHA256
921410ab7dedd525278ade863c6448cc29aa869255ff1bb3400e2d5a7432ab30

SHA512
6ee074fcdcd728f210f5dccb2837f38ac05ba6185de9fd9d045ee96e5cb01adfab95d345ae5c36ddc6f54065cb169718c590e13e5f2557ee0ffe19d58724ac12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bdda90153ceac2c18d2f379193394583

SHA1
7b9c42132e428291f398061318d39f6d0d5a4ae0

SHA256
e575398db92190f4287e61e0efbf2e06d67a162a74b9f3294aace87925f30ff4

SHA512
40b76ce7f1a176a7c03dbbbce055825df55236e233ef9794a8b3186f332835692bd3c475b24dabdd61b768f87987001f016a233ba86ed1406d76e265cbbf448d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb455ca75ec1c0160e5c8117d74fbdb8

SHA1
baeb27d317d65170441e3279e82a12ad25904ab9

SHA256
a13871ec8cc2e7cb202333f59948930f9aaaee7fa4556e473127901c4b181063

SHA512
3c8752ab8153df6aa1cd88dd8495602c1cc272c631d85008605bfcb36deb288eb8bc51421775616272035e4f60417b5e9dc115db4bb329033c0eea8c085d5a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
74904fe049ca69c3b505d7fd54043aa4

SHA1
d4944e5a62d090678b6d5c606f43f43dd878fd10

SHA256
97104fd6511b8ea103b255b2a5dbed42dc67f6d5ae21119e5b4cde24964fc71c

SHA512
7010d01c18ef3ff22251c8de65590f3455d5649e30f3fa70f9c317a7fee19a01d6df565548fedf5717128ed14d3ebf7bd9d941297c77aebf72f7ef26b5e79b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
266057f5cef9b0d695ae7f6d42e48f4a

SHA1
23b33bc88616b7c65a116be6bd7aba640fd1d6bb

SHA256
7795c982213cd3a5b9700a18baf442f594caaedfdaa039af59dc7c85649be639

SHA512
40be87fff04d584fbd4d8841e2697fdffc22e6e44f2e6129209178d366e7aeb04bc592dd6c56f6916e33fa1ac1cd0024ca6b41bc3c76efb7ae86b77c7201b390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c004.TMP

Filesize
48B

MD5
b21abe72fae278155b653b9824e5d8dc

SHA1
0b4fc9fa56bfb27efb93a6ee67c03e9efe83492a

SHA256
be84b3887fbae7f4667ba7e93363f580c71c1554e9bd2cb851c53d4ede3500ea

SHA512
fc47c160145768d5073407a3271fbbf642e528594e70100ebe52c281b1272e3392ada074a7d4c4ff41fd96d0605ab8c52e67393564b32fcd09b9040318064664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
453b90a1218c48b295c755c456bcee4b

SHA1
db10a29603aecbcf9a4f7fb68b2eaf83ba62be19

SHA256
1be34fdc709b0a803902fb3e60757eca6423ad5745a65ce159003bba7ce8118d

SHA512
e7f0b0985e016d18dcd9d98754fcf31351ba49a0d488d0d2b720afd65af3e2e3cdf06ccb0685626285d7bb0eff0c212f0243ffebf0fa984e94057751961e96ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581db4.TMP

Filesize
1KB

MD5
d6bd51b15db829b8edab374d28884536

SHA1
32c4503139b0607c05bcacd3374d5409b0d820f0

SHA256
3c842013e63d5544bbe6dd76849b5765d7651329d5aa61d76d20f956b2637414

SHA512
5762ab3a69670c9068a15e1fb83c62c1dbae625c3714a060da2418dac2a470f45d79e855dac7f34bad4ad582907227c5f2234a48a342c6729e272bb6d96ebf78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb7b5c0d759da432aa074fbdedb89bc7

SHA1
8baac99fb0cdda83e42f2ca85fafd4f733e7250f

SHA256
e6282e00edbf03df9f31f8f49ca1f490bc49fefb0ba772e61b65d195a55fb7ba

SHA512
2199da98e4f381c4ea92798f30fcbbdc9daa9b6702ff6ea0114ab09187b8f93b8a3e8cba2186b9028cd7e5f2b9b0bbf8912bc444b32a656505ac3c22d9ed0f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7dbd31c167666120ba8fc8a9d87a0508

SHA1
873b1d8d57654bdc0cbde1a44de775dcac732155

SHA256
79252b36fdc1d72228617abe9371115dce8f51260c5e485c7a0903151d8b7e42

SHA512
c4a822d3c0b0d416362d3ec8e76849fd60fed4cca5507f08696590b988e76a9a5e2a3ca6c5aa82269c4e8eba2a89d94524d40515efcb2bde9908240e8bfd7d9a

Download Submit