9f989b7687e9422b628d4ccdcb3b20075abef18deab9d21023c9977b082b64ac

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b85a7ff5c7f37665e9a9d39f473a4a48.html
Size

432B
MD5

b85a7ff5c7f37665e9a9d39f473a4a48
SHA1

d62fbf240b053eadc3342e663e5bea5140e87175
SHA256

9f989b7687e9422b628d4ccdcb3b20075abef18deab9d21023c9977b082b64ac
SHA512

6844f5ad00f4620a7cd720e713ac462735fdbf4a9eba3bebc135e04ad45717b039cb729923c324ce11cd513e78d3bb3efad776deb35bc4330acf46aaa0de87d6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
2888	msedge.exe
2888	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2848	4292	msedge.exe	89
PID 4292 wrote to memory of 2848	4292	msedge.exe	89
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 1336	4292	msedge.exe	90
PID 4292 wrote to memory of 2888	4292	msedge.exe	91
PID 4292 wrote to memory of 2888	4292	msedge.exe	91
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92
PID 4292 wrote to memory of 1744	4292	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b85a7ff5c7f37665e9a9d39f473a4a48.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff8d0c446f8,0x7ff8d0c44708,0x7ff8d0c44718
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3435331744723779548,11654136522945607498,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5224 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
d812d48be9a8b539b507ba2917395a68

SHA1
52784d5ca87f8a457c93abe17ed97b2c853657d8

SHA256
e67231281f91c6557470241bbf5b253af2f57c30d0f5000010fb733d4c70caba

SHA512
42fbdfaf9ebf3adcc5aedf914026970a999bd0480cc6eb9ffe048f8602bf701cc2917c943bcd3b4783f5435c272e98c5726cb8f40d805742565125c448416913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
113c24f04f354b110b7a6b130fd176e2

SHA1
f45889ba4baa7da3c96ed29c2f209e53b6c31608

SHA256
210f45ed47454ce53bfa96a1f2595b49fcce2195a4d059ab2366222f006d703b

SHA512
4be9d4c222f3267c221463da6a38b74485395122d29bd78d6505ba4d76582192bd4db181d3cd759b94635a65907904e646b059cbf0373df7101d4748000f3a06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3fe01e7ffb25670df178916c7230d434

SHA1
20f43c2989e19a8f94e79ac3ae8434c4d3a68052

SHA256
23770ec604bdd7dfa2f2b636e697d7e179caec32a7f7b5da9551f57635d89eba

SHA512
b7ba7dcd7b04c5483d1571f4fec6036a039854d5ec5365f8f9e5383e55c2ee6ff87c5d2db22eba3cdd1837a7b0f063b7c11eeb32487a7d05ca703cadaf9beecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2150d8596d2e05ee2d007a4148b8b063

SHA1
2dbe8d29647c49bfd1bfe466501f9800b6abf8e5

SHA256
4d4e311c393bf12062011fd14f84c87367934c607d51ceb9ef751ff566c14a2e

SHA512
6d6fa771443c4db50a979c358893f813bc182319c23767f690296c637ae8cf1eae7ab088c9a5e6386ed784dfff5c4105b1a793fb969de86ed481d331e2abd102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f761fa30d0e01dfb40bc0ec58e57cd97

SHA1
7832731425a82770817fdd0754c05c55d9c92499

SHA256
7f3c5b35cc5cc607c2dbe1f49168b5dd054f9806b0ae95003120aca7af43cbb8

SHA512
25b372be2f53fe0cd21a10e831f2b8c1047d501a73f825f830bd859ef0e7e6e705c7b057ddd3c03842673c5d763a1adcceaca2c2af0189ec227ded1061d95950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
61f68d156014bcfcfa8a45ad03ae3997

SHA1
7c27934365a1b8ed87bd6194aeb5982181061145

SHA256
e9f05364153245ac8a08cd2fba830c9d1d114858a71b7987cb1208631fbc6bbb

SHA512
a02d03102b3c68ba409d5c7c07dd3a644f3746e0b7b3e4ecc21f9bfaf4f831afdb03f6dd76bd792ffbc5e4031c3cbe90f3efdc6aa5938a89cdbd53ab66b0fd1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e950459ff0177d9c1239391631ffa40

SHA1
5705aedae814efceeb8abd6e3ea26dfe4e1a5457

SHA256
d311792ee9229fdc8bbd177c4329f4638ce123ee59f44513969c75ccf36382bf

SHA512
ae7b12f5278ad80ccbe01bb5a2b1656b6a58e88dec457c4878de3261923045e4d73d2aa6d6d3a006c9a4b62afa39bb1f4f19694437df73590a733ada84ac6669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f4765b535a502aa82d76a73984a46f66

SHA1
2a7d42619e79887ad20b6c5e79782b5eda3777e0

SHA256
53522020d91e62376a7dccc51a63f82d7b197118493d254b9611f13214e1155b

SHA512
2c7ecc0189766e5e1fd947ae0e18e83f3fc08e8dfb8eea6eaa03c82c47b1b9d281693f360cd17c09ad214114e6d27f778adf70a7c6fc95a8972d0167cfffcbce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579172.TMP

Filesize
48B

MD5
f87081b8b17fff558b9952a6206efaa2

SHA1
94c5766778921363aae47a7a306f767eacd657e2

SHA256
988f39b0c65f8714471c2e8938455073ea12bd677776038d86fea5c65fff80a7

SHA512
7897280e5f205e4f5fb9f36578e53e186260ca1412cecb2a4c5804eb9f9fcdd9061a76c3a70995a1a6134fded40fe7ed7a652d3311fed7aca3acc882aea133d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
76109bcab80e90d86e6335ecd87f58e2

SHA1
96de605b630c3759f309e5c7671ec87ef499638d

SHA256
1220f804d209595914fa595951a2d119f3f8046f15ba63708f1e12ba1005269b

SHA512
4c513bd4e56bbbc6e85daec97e5c048e4ebc6fd9636aa7051104ae8e610ee2938eb9fed97a760988205c565efc9c217ca6efc1e09fc6723a8fcf97395d7164c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
32d8b2db74e08890d95e2134f7ccbde1

SHA1
0362fa0273a083ef5e07ea992621877dad042f6d

SHA256
c5ba78eea568b29998a67a762fa3f0870f69dbd4a4c8ab7fb3dafd44b4ba8aa9

SHA512
f6150e74ac3f240b77db8d54369ca1e1b831aa67766af9234771770fd9ae8111ab8b24e533ee105f9711d13f0ef12a6b889a85f0c8469e8df6909eb9d8f32e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d7b3.TMP

Filesize
1KB

MD5
da7382241bcc6976e001c35a5dd37883

SHA1
4e9df7920efb8a72977a47322642a6c29dfd2ae1

SHA256
688e36d7dc1a5bd9cd8c64641024ce38bcf414c4828e917ed6fe115b6492fe3f

SHA512
c19df62dbac75e14966e38ec76b5184a83ae339687daa008bbfebae275add2f9329bc2c3530dc0b47eb428896e367c1c6354ca16c38edc433985357542ca2075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
26bcd92ef2249befb93292c2707d0a98

SHA1
bc23ebce0381d739a6778f70f6d6e8c670360643

SHA256
6e236d656bd6c0fb8dda96df9820878f8607b752ad82e179607930c05704dc87

SHA512
665a0a92553ef0d8191c0799c1702e5fee15ac078eee2be6f3cb201b54837d55f8a423bc52545c9da44676e1e6a7185ecbe99357d86debbde031a48761c04947

Download Submit