e64faf07091d6be3231e73b409e3424293c3d2debe9faa80868ba7b97f77f32a

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7a4838df2b849f2767f79bd2e8c5d20.html
Size

20KB
MD5

b7a4838df2b849f2767f79bd2e8c5d20
SHA1

a8026a6cb58e2d9738a7e5e4e8f4f9df07e579a8
SHA256

e64faf07091d6be3231e73b409e3424293c3d2debe9faa80868ba7b97f77f32a
SHA512

d85c5e23571d4d4ef36bfb3707ebaf3fe9f447cac0592de30ce0b4dd1e74d663edd96fd8a5ad5fac6b2a1a89768f8b0a0c6ec8b21b3e6b01284686b4a7d479d3
SSDEEP

384:iu6QKHo0lBH3gXKaIOHkXfITHIDf2CgoI8L:ylGFEv3L

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
1952	msedge.exe
1952	msedge.exe
5996	identity_helper.exe
5996	identity_helper.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4772	1952	msedge.exe	89
PID 1952 wrote to memory of 4772	1952	msedge.exe	89
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 648	1952	msedge.exe	90
PID 1952 wrote to memory of 908	1952	msedge.exe	91
PID 1952 wrote to memory of 908	1952	msedge.exe	91
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92
PID 1952 wrote to memory of 2120	1952	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7a4838df2b849f2767f79bd2e8c5d20.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d7846f8,0x7ffd9d784708,0x7ffd9d784718
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15192920734928026547,1179716414602392332,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
149ed943542b82b1525fce8cf40c0c38

SHA1
66e78effbfaae105c6decfb20dbd5f702f9fea5e

SHA256
3c8b3a502686641381c728932103a1587376371d01d328a8bc4a247f21208859

SHA512
27df147ed2d8e7d18bc7f3718260244c7c6f36b5ad8269676adaef5bb4c9b57712d8239df66466eda00f7323195129745cbcf6c9450899f496aa2aa786ec8de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
20b3666d4c6a5aa9adc20f0267fad60b

SHA1
c5dac8f45542055d1ed946d9beec42b7db7270cc

SHA256
6a786a3fc15c80fc980c72ea4b743e01a95f3557abe4e0e80bb6f3fd8d0c042b

SHA512
020a7c0d98115d4a78f079466c61059bae38bddfb7c87c9edcf5c52f2cba75c4fda32788aafd49b6eb24771fd378ae723e374ef562ad983d8ab847fa9faf12ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
61a08255633e801ff2c3f723dec5b492

SHA1
26462bce0ad8b45e51889e25810f58a0dedb4d29

SHA256
7825bb10d7222e2f287b4f63849a89c2ad229ad41acb9b389ac16ea55c7c1b84

SHA512
79adf718f08ee2a65e2788d6e5fd1904be8f42b3d76e45d01c425ba36d369d0dabc933772d7e952e31383fb7fecda2f5e7193150d68c3ac55e6164abd9caf560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
df8527e514c5e720375169c38780c4cf

SHA1
8db3438b8ea41543093a47efd720c272ac6d3e84

SHA256
58b8337b07e5172136b580757f974cedd7b883ef7795a2c66453acd56c1563a0

SHA512
f8053310acfbad172d9dc5c3cd6375b54b9fe1848fc3c004f33d0fd9cb4b0e7dd096f1c83902924c1bbca7294902f9ee4195d9e9d838e394d1b2191753b47639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
feabbc1d9862b1af6fb0c55dfc64bdc6

SHA1
da7d4456e630d65127353719e34a668ee8ea9f0b

SHA256
8a50f82882c2358041e6d7cbdf9320156efaa5906469299e6629613cb25def7d

SHA512
29320d6bb26ee487ecd1468a37d23cd8115a4a0e974b92cdd39d49a688e721aa6f0b54373e9fce6464d071679e9815b9b840950f7efe614c4022d054bd9f7f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
579fdb66731e0598e0490398bbbc69bf

SHA1
e4db9a7fa69b83f3b2e35d7d5ebd5e63c451cb8c

SHA256
4b1b7c3f90f422a870c96c25b34ac74e1b40d9ccd44a5f84821b59f7a90f67a9

SHA512
0268f56eec18495a05bd6f36a9d45908d42b98d46491f773026b529e5ab6cbfc274a8da813f38281b235d3c9f8fdb5a84181f3beaee7b521a082f3c3d67c0560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d4220a408308f5242398ca68f53dc561

SHA1
78b0068b992411cca8cff8a889817dfcfc753196

SHA256
137f707b4b8f4bb6acfba7539fdd7b74e6fe46b2d0fcd208f184d5399f1f35fd

SHA512
38f57f921d7060c73c6bdb0c9c896048ce3e4f4bc8a967bd66ad222f7dab7adf5ec5a4dffceca342b689d946eaa7d7d73c8e6466d13372513a99a15e20790192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b101827d123cd74e56581ec4ea3e9c4

SHA1
cd46948000361898f9d94e24180a3d6511267999

SHA256
d95f5abfa383cdb3ad5796a42437787e4cfc9c8a414677dd458d48fd53897e6d

SHA512
8eb9b549d6f60af018355976cc8e66a8b53de9f7eec8be83994bd7ec01a91215580a2c68b7ec72b269b5d5a76370acb343a5c2fa2ca7dc8606d008cd693bbd49

Download Submit