088ff62dc49a4f47055d3a9956aea1181f385d7f814418e57b1785d55bf27a0d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c262ce1ca21efa690eecb11c8f969a9c.html
Size

198KB
MD5

c262ce1ca21efa690eecb11c8f969a9c
SHA1

584952313be4b980a3e0bce33074b6383cfd5adf
SHA256

088ff62dc49a4f47055d3a9956aea1181f385d7f814418e57b1785d55bf27a0d
SHA512

5e37acd959e1622dccd640d4d02c28f77098f0967c57a5937da7debcac3dd8a800c50847467f199b13e7dcb285ed6268aa4a190eedcda038e604e358e65a783b
SSDEEP

3072:dB+1yZ7z1WAZuMIQWEFw3MLGG9lE/sMfrmBRPcTq:n7fvSO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
3720	msedge.exe
3720	msedge.exe
5992	identity_helper.exe
5992	identity_helper.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4020	3720	msedge.exe	91
PID 3720 wrote to memory of 4020	3720	msedge.exe	91
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 2092	3720	msedge.exe	92
PID 3720 wrote to memory of 980	3720	msedge.exe	93
PID 3720 wrote to memory of 980	3720	msedge.exe	93
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94
PID 3720 wrote to memory of 3348	3720	msedge.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c262ce1ca21efa690eecb11c8f969a9c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc3946f8,0x7ff9dc394708,0x7ff9dc394718
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7227728547844359442,7845304729393815711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
1036ac6817c6c0b9cf902ce6d4033780

SHA1
0a3ee3e89651190039d88c663a4964785c753743

SHA256
2aa20c6deda9c3948f81953bcf7754c77cd9e4dbe5d6b9ed98834c636ecdc691

SHA512
442e5362ab93eb1b43e75cb21422b46265d5309bff4bf53d9b6853d2c2fc5c9a611374504109dc5093259d758d4e9a5bf5e18830c57ac0bb7b59eef988dc5685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
56336dc4e14db9f1b8d32a7f79e0de2e

SHA1
791a5eb1f7fa80c0f08a4459a45afa19b52e2448

SHA256
e877b3a8f802c2f7f182619f5b7343725d02c956e0f07c646f1cf07df98ff33f

SHA512
cd27548bc2a7a6ec66b9cb75021e0c8eac8e7fbdc824715363ee5b4c7d4d51e6f289ba74a8a6e4152b06c4c195ae26e6bb21d5a9d46c35062ca48c4730ee5a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9313d59b2bc7b7d2f1a14a1649fb26ea

SHA1
31f560e3e3a713b111ac5b3ec2079f7f368d3535

SHA256
f7f5a66e4bcb86050fda991140f064639f3b09d16e99230b8ddf3daae7ff4397

SHA512
78bb0a73f0bda057f74d354e493148e7b536055a06d47a9db57d841524cf2b14f9a497c0ca34caf21a36929b084070e0ff7cc312a48034dc3b10eb17b4c89e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b67d673044ec68ad21a512b108ea7303

SHA1
13fcf803d6fe60f9fcf422bde616b42c06ce3739

SHA256
16fa5daedf93db6c170881cac60d7c9859fb171c469750bc840d0fe2e1414ce7

SHA512
35e9106b91b063db47332d350e48ab5259b8fcd403c33555417a4c9d8369aab78886497e25c7c1642eaabce157d0172a0eda9aa956b08ca0a237ee1631fa6f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a24a9d7dea3888fd8765067c52e380c1

SHA1
bc42c05cd23351fdbcc6f32eecf72647f0b6c80a

SHA256
56754c05e068aecb86e2a930c75c8ea6bfef0aaf2d95ec75a32fe00e6f81f942

SHA512
a2dbf4c07bbe3e2868abe87ded0d044a6f5ef51b5ef860362bf09227a0f7c16da6c312c17ac82ed4f9d6600c80efd778aa2d7d8e792c63eab43edb9897f58adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
34464a1ae2fa111e36a39db786407410

SHA1
26a283b68a8dc34f66c8eca49adca95025723b11

SHA256
b7f52403e493fe6ad61a4de3ee502a22bf2b87a3da7c708cd67c65749b1d8e64

SHA512
5e9ca132b60c08376bae6c8122644753ab16b50f2a0083d13783826d7c2fd373104828ba1727c45cb60d650582a8cf20a8a7ed80e28551fd08b625086425200d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
5543423a59bf5d92bb8355a33fe1e5dd

SHA1
2a8da837b3c5bfb0c7e15f0fbba23ecfaebcb15c

SHA256
c48df45189032137fda3a949e355467926f7d093d0be3e49412522e3c65be934

SHA512
5c9751fb0af2a0ae2754e2f7a39cc9741f73a457d807930802a8ab4af45bf17519c0fb6909628f4c72fbc5203f8a2d55266b66e1470f9e3d674b545f3834d71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b4f8.TMP

Filesize
537B

MD5
8f223b370703c0ca9eaed4073b300e37

SHA1
fd7b13980c4dc3537e8aee4ab371f2875fe392b3

SHA256
7f9b5eedf1c18e8738561ae6b5233f866fa42247eb1317e742a69fb119fc408f

SHA512
97d007038dfcd2d03947c5cc72405142bf28738fd61097634ba17e07456402bfcfaf28912f85acf292ead7af98bb1de672982bdab7a1f8b2c8428b4716df5a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4492c9e351e8d42c1d4fd98de812575

SHA1
f7bef640c91b9c1e03b0ab70d0f0f5ad704501e3

SHA256
8341cfb774ec302a640efe3bbb784df0eff7e14f3d717cebd883b8cc367cb973

SHA512
d17893ddd8d0e066e8168f37e5a9c080bab9defbb5300086a9b2c384098d529f57514523568c70228195683c1f839a44f87781beee390d0018b53132222f3ff9

Download Submit