e387b94a1bd5cdda81e469086f5f7e094b6286e37b1a47c628239da942f80419

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bef66bbe22a3366f643bb773d0e26e3d.html
Size

144KB
MD5

bef66bbe22a3366f643bb773d0e26e3d
SHA1

d49c867979e8eee04567ea9f533b8a0bf94ad575
SHA256

e387b94a1bd5cdda81e469086f5f7e094b6286e37b1a47c628239da942f80419
SHA512

a322c7afa01b7d35a8f4ef9ad3c972e4d37f2160038e9913f43fe543ed440106c0ab3f87c85086d9533f77d67614e1468f5cdd593d466678cfaebaf6cfa6762a
SSDEEP

3072:1BKsFiu7prO8YIWZCjvYikZI/nyGFdgBI9qeYStv:1BKsFiu7FrEEFWSqO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1864	msedge.exe
1864	msedge.exe
1896	identity_helper.exe
1896	identity_helper.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 3288	1864	msedge.exe	88
PID 1864 wrote to memory of 3288	1864	msedge.exe	88
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1412	1864	msedge.exe	89
PID 1864 wrote to memory of 1156	1864	msedge.exe	90
PID 1864 wrote to memory of 1156	1864	msedge.exe	90
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91
PID 1864 wrote to memory of 3068	1864	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bef66bbe22a3366f643bb773d0e26e3d.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5b3046f8,0x7ffc5b304708,0x7ffc5b304718
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16433098074615330191,1868916292706663110,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6b45b364dd5780c3f797ffbbe4a3a1df

SHA1
181fcaa99c184c8b88af8c995b9c0a219fbb7a65

SHA256
48a37aada51c76df32a1d31018633ec2cfc7830813d43a37292d7fbc4566ac4f

SHA512
05b1a487adeae4794bdfeb25e3764d2b24a235a913f2c934d74e8adcfa2fba4bcd3930d2b938fe83f8c8a2438c0140f701eae6ee49075f52c0b8e83a52ad86a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
51636ee2b4722f31cec39f5d7b65c553

SHA1
042c24f6f4c842bb19a14455a891e3c7c5b04dde

SHA256
f1e1ca0a6d89ef1cd698956a10cb4132cfd1b16e090b48bda79cff1037666eb0

SHA512
ef2b2b9efb5cc1f0a5fba2484ceeb99eee888ddc784b0e73e06054bf546b129e1c2b8bd5dafb030b0e95f53136dea4d28b81e238010d764e4e425cde27b87f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
29c6819943a68cf45d2e97d953b74bcc

SHA1
01de07b73d9d9b36d2b9886a176e3dee30cc791e

SHA256
c9549573ec43a91c562a13ef6788e6a24936edc8153fd5149e1d1162aee71726

SHA512
ab12a316c2a4c297e98a3ed050a3d1288cd49247132db49ceb8a1a30f611f45792f408a1ae3b062d9715251a60a2dcffc0ac5de250d6024530de204955647ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aac9fe55cdb65ec547bef7a82bf3f3a7

SHA1
0dacbd3a8013922e6e24bbb920224d7463c21fa4

SHA256
817aadfca8618a1c24340c2dfc9e1c65593b9e87de23b254aa5860bb8695d635

SHA512
7768f2507ab81257dc2eb074412566b1dca8d7cf4406ea133357a35e4bea00b92bdf5dc5922ea172d5bbb705934c832d1e092e34b633d7e5a9be44ce9589b4f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca364da934a33e75bcb8bc325e0cb8a3

SHA1
c372c3f49c3e04ab3e8bb25f7ebdb696207d7bfa

SHA256
b8255c5e5b826cb572cca92daa1609f7eed46c6da32f626789bbb4f59b611ecc

SHA512
ccc20cb24f410172b905a45ca6c13a9bcdd5bdce67e1acc4373d727ac2187f0894189fbeea1ca2468aee77b210aa225e47142a3a8ab083d2416deff22f53f3c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
265c02b63b31244b5daeb19e89a4d153

SHA1
c54ef504a0710539ad085b9f33bac077cf1b7558

SHA256
69d0452535929ee407a1979e49c2048771853aa51b00857894fd020f13fd8507

SHA512
7287335ed6346104950ccf478d2e46afa1d59484872646fac9e48df898d41bd1bc6ccdb172191f0ec578208e0f1cb2bc06a1dca188fd7edb29dfaaf3ef3c4d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
ce05c81ee13cf58270e8653dc9827969

SHA1
c175743735ead50813ae9ab66bf696495dd5115a

SHA256
a4c4cc0ddb2e5c979b42cd38ca8847494bba05ddf8d351b73b2f39f6ef0ade7d

SHA512
bcbaa1d22ea0e6cc0fe5de86616098268d52d40ce1135ffa364e8f57a097d2c8509f568fcde313d2c410d4ac04f18791cd5e93b8e14a4488cbf3a803a9c47ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fda9.TMP

Filesize
201B

MD5
554c40132d263965fd1b515b9b1ca56a

SHA1
870f7854b05a3b9dbf52d59363d41b5340a46306

SHA256
67fec856f479066ce9314b50e05a98382a2395c0ed4fdb290132cb690859bf3b

SHA512
f2ad7e50b7e30e498197b7b52a4c45ecc578373f9cec530f284264a66054c5773c27990a0df435e6f332f1c209cb6e8a8be132e10f5bbf9bd1a89ab75e9fb8d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa41f6b5d24027044fe22c00bd3cbf8f

SHA1
11df7e22ffe7d54abffc051e8d4d1ce70aeed97a

SHA256
cdca90d24dddba4bc50c8d23a877c003ad0080fb3c56d2ad4efa2dd8e4ec3aaa

SHA512
5906b797dfdf82819d1b28612d99be15f50e8a8a90692a25ba4eea29f2b536f722bceff039bbe80253dcaebb1cdbcea014c7fb49e9ae965b69bfce8e702edf38

Download Submit