77828654ed82236dae1ef22e48dc747f98fd2cb48024f53c0ebef09bc8e8566b

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2a8e4c32483c69eaf55f1bbfebbceb9.html
Size

432B
MD5

c2a8e4c32483c69eaf55f1bbfebbceb9
SHA1

7479da1e27f6d9987f25d76099507a00e5f0e9d6
SHA256

77828654ed82236dae1ef22e48dc747f98fd2cb48024f53c0ebef09bc8e8566b
SHA512

9b6b6c2a6faf9b3b3b934c22e2ec3602a05febdd030f090b20b1283e10efef6ea5cce532f3a1e1de2f65fc882724ed8e5e9842037bceb7c5c861e393bf595b96

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
5096	msedge.exe
5096	msedge.exe
3412	identity_helper.exe
3412	identity_helper.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1488	5096	msedge.exe	87
PID 5096 wrote to memory of 1488	5096	msedge.exe	87
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 4052	5096	msedge.exe	88
PID 5096 wrote to memory of 1592	5096	msedge.exe	89
PID 5096 wrote to memory of 1592	5096	msedge.exe	89
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90
PID 5096 wrote to memory of 2824	5096	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c2a8e4c32483c69eaf55f1bbfebbceb9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecbe546f8,0x7ffecbe54708,0x7ffecbe54718
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8616229481268664190,14113582339670111714,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
73c8d54f775a1b870efd00cb75baf547

SHA1
33024c5b7573c9079a3b2beba9d85e3ba35e6b0e

SHA256
1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94

SHA512
191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b206e54d55dcb61072236144d1f90f8

SHA1
c2600831112447369e5b557e249f86611b05287d

SHA256
87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b

SHA512
c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
79aadd4a2c460aced92db276447d533d

SHA1
215cb3880d6a81edf99739265e2aa8079f4936ac

SHA256
fcd23acaf7b540f2cf9d2c6c7636e928f07101345d15f9248c4ac37393adfae0

SHA512
ec72892a1da2510884b216f63a477668197b904886cb9b833963b8854b7aa3241875ff355ca163049a6e656ccb1bc4ba67e4a0613142afde8d2883b641463f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0b506353330c46b00a48ebc54e146b7e

SHA1
1b24e84ea9ab45f974652a97d5fc5a808c3b7e61

SHA256
a1bc4929c82b9fd2fc54a96016b9836cb07417efef53ce47d582c2eb934bdcc9

SHA512
392c75fb72a8e1ece0841e6becaf66995a0e5aba8e96104a1f5d176b9a1dd8e3196d2cf19455cc82ccf239d2180fd9e06630c59ed1c17636c7da017ddb1eff52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
627e23a5d12c8c8a07717d8b11fd577a

SHA1
87463a6d5f1f892838afa6c5462ca7e62567e7eb

SHA256
6a9b3a5b7399bcfb7ff163230f3e1b3e30d08036cf76736ada4f6d65a45761a7

SHA512
812a8a47966bd812414f8323a3b54df4283a5d50a189a8f9e6f25942356cc4772f26c22cc5f88898434a070f2bffbc652ef0e35ebc2fe093d43a02807e513f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6aac334b4df77a1b00ee8c3355a2352e

SHA1
b0c946732959140edfe9f46a65440b9c8078fde6

SHA256
0b40d169615f29f8bec6e342c2a0b62e301e54ce771f2eb8568167babab6f453

SHA512
0f2df2022f6257e1cf98fa7f67e3a745cb6e8c186af2c0f05c59995b8bb73bce201cd57884476c6353f17bf3e88b03c4404b70d4b684bc791a66196bf4bcc461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
75b0c342ef325c8a2d5f2d591655b724

SHA1
8f18cdbe4a21966af687e11a244684bb25e6786b

SHA256
cc9b4a8cb250db2b409701dbfe35cd090b0cdfcc39bb0b54f8880f5d00e94090

SHA512
31bb40b53e845c58075bffa328d49fc4f4f8ee5bfc0b072735c2c2d1ab24590aa150182dce68546f295fbd43ff664a28ba0f8421a7ad974acb3ecb1893554480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6400d0fe954f62b04d8d90e7e213a160

SHA1
8e7bd08826bce4de3c44e3dac9672f35f0bd2afe

SHA256
d687a9fcbce531f2cd656159f042cbc8ca2adab3039d2e4b077d5975163a1ccf

SHA512
13f6a0ebc25bf7afd8a212ffb5c5b80b6e3e7ed6920ac2eccb5b3b0efdacada503bea8de2f951ccd84dac8379ce47f48163a0e048710fc57b091b27e62c7dfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57be9d.TMP

Filesize
48B

MD5
1a37f60cc801af04c95f4560c009df79

SHA1
e5ed95255697ac67d808ce0be93a7ecd340f6bcb

SHA256
4c0ab7b8f28deab491031e77e4b39a7400916cd09ed8f8a44fd839bf9a47ab47

SHA512
e29da73ec8ab7042200f4a1564faad29a76e19f68bac46f50f690b8e1f1da4a102958a4956bc48f01c40598eaeb0cf40139df5bf8609b26ee85fe9bbd80f6240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
298780a5a974b433d7cd479519ebbeab

SHA1
767b7741b33cb038c3c0cef48509f0584d36b4d7

SHA256
d7e2cbb9dbc6901e31d409f2c22599e9978d90d834657d47941c51d530a730ce

SHA512
b4625abd4e6f0b6d16871d49ae583eb6f532503e349fc667e84fa00961e4c0ef89a27352d6c7b4e285abc92a02b27c57c4d842d011c65fa900a2bb524c3de418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5805a8.TMP

Filesize
1KB

MD5
6048a5fe14aa2b7da2935f589f24b752

SHA1
074bf8159f092cff543afd4be0d7a5ebef18c926

SHA256
f3ba34aeb5f839a34b0d8a83d4400b69adce3b30b9f8f0dba8913d3ed954c8d9

SHA512
af096a8f86d348db88ed9c353fa3bede6100105ba0663ef05fdb899957ae42814e68a42257755e4e3ec6b676a59fa6829551e8604f052b42ad8f573a1a16f44f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
29a4bb2455148411d12fcb9d51f2244c

SHA1
f5b8bf35d4c3860f4867f2d24228660e6b578908

SHA256
af8cce83de5cd4957a61e60638e98f5ee4dab6b606a163f7ec782cd1e4228521

SHA512
7133e1d53841352e3f9af5152d7d5110507a1a1fce3eb363454eed8f682bb56d69d11e84fa5de2435fbbd7b36efb02f674088bf7e9b899b72fe129e379b0b710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83efcd77ddd42ff1a9f2a2fa5567f3af

SHA1
36d0807beaa3624f49054e46659837d8681492cf

SHA256
fb89335ef1928498c902c08dbdaf97e99bc161dcc407a4bf7247ac3eeeeaade1

SHA512
606d19359aee2e73ca7f841f80550bb4f57fc18d6e7a1cd11a55ec337a90f4b9b7966501b9faa4e25e940f838594b1e443f6bceeaeeeac4cc10fe7242edf9d17

Download Submit