e2e7f7f8471bfa9f5eac3e13d7cce8f5828a8f79937adee2ee4f53fd0493d81b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c4215a1187590ecadc19eae0a00782ad.html
Size

57KB
MD5

c4215a1187590ecadc19eae0a00782ad
SHA1

01013a0c47310d18210d14a2ef6219c0f830f164
SHA256

e2e7f7f8471bfa9f5eac3e13d7cce8f5828a8f79937adee2ee4f53fd0493d81b
SHA512

118965a919945714b5d32242c24562b2ee7efc3762c16c8e02953949e50bdcf250462f5e87d73325f9bd52e6ff1c8562b34239e254bc832105f25d0409dd3849
SSDEEP

1536:ijEQvK8OPHdFApo2vgyHJv0owbd6zKD6CDK2RVroL4wpDK2RVy:ijnOPHdFL2vgyHJutDK2RVroL4wpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
3724	msedge.exe
3724	msedge.exe
4924	identity_helper.exe
4924	identity_helper.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4128	3724	msedge.exe	87
PID 3724 wrote to memory of 4128	3724	msedge.exe	87
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 2144	3724	msedge.exe	92
PID 3724 wrote to memory of 1356	3724	msedge.exe	93
PID 3724 wrote to memory of 1356	3724	msedge.exe	93
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94
PID 3724 wrote to memory of 1844	3724	msedge.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c4215a1187590ecadc19eae0a00782ad.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff515946f8,0x7fff51594708,0x7fff51594718
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11780111285363187870,2591079649493944373,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6552 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
12424388f7f8908a05d9e50fca24f59a

SHA1
172e7f87194fb537c889c2b0662588fbc70fa2fb

SHA256
f602a6de8a7935c0c3e924d1742af9e63f8bc67e3d1f160bd0806158dc8b1991

SHA512
5cf961200a1b7937af353be6f8dd63d75fcac425fab8903d74cc2dff68f8875941df4a29312a1c1944497e70f22593a72dcef63363709c8fb5b8003852b5023d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3b69fc267f3b4099893345a546df478d

SHA1
d40030f1ada1427a1e9da086241129ff1d9f557f

SHA256
e20ad2630155710e21a1dbe4bd797e24bb740805f2ed8db181c4c23d9cee36a1

SHA512
71e8cc3998f86b07afa4997d3e87e67cbed65a93ab00a6050a9bf0d76dbd290b8b815c34c8f285ee0306daebd9c3cbb0a9aaf2413663f63b1c68b81ff1fac1b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d25cd842aec91ef2e7f2c7a633f571b

SHA1
629d6776335f56812f457f5d7d09cdcb8f64ac89

SHA256
8672122d750490e4d62dee348b92fa2643be1d2a0371c16adf470e3eb517402e

SHA512
faa6b861dd7a08ee74a68682d98b9dd6069c2fb054f08f276e9c189cd9ea603734c2718d6a10bffc6d69400eb033f1fc46769845857b44c1dc13502562d00fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
646ebc53f8e73cadf194ada5c51f18a3

SHA1
4b0f60a21f484e3b72dbce5e356905f2d88b1787

SHA256
37170f07e8876607d11f9cd62a68eb2425c12fba536ce01be7fb2d6552879f98

SHA512
3184bba5ce19edb7da2156b17dc627eab73cf5e6a6063eff8b6c190347026e754b7e512e6afe1e8c36ff481465a6eee2d7cf5a6fb69b90cd74b0ba9afa2341c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a562883bc7f7a080ccde9f53632112a

SHA1
e2a2fcdbe996def2d2b17b27ad10f4bde094f62e

SHA256
2ffc30245e8900315c36e5ccab09f04eb3208cb085c08b8dfb0effcf02d5d884

SHA512
9eae9739a9b02ed56ed70ea2bddf8c661a7d4dc91c663f6011b7b9b493a5cd7b8f5aabe69cf3c55ca09a12c1ce06b43458035da82ab82b85734725b7a67c842f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3dfdbb00f7c53914a291051ff8e7b8cb

SHA1
7c569ee296edc2d64473d7f234474a80a1e14311

SHA256
cb46737607abed691672cad80616085bdb29d801a2e67641c5c6173073ec7886

SHA512
47ba15bdd78e92233e1c1230324fb44967246d72126978485890606b068f74f4a0528a91e8ad5a82c2149f421a84c6882e5d15a0925e929ed5392c61d3c82a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8debd2c058b738368aa816461c73140d

SHA1
e5c3cdca04c46e7270f05dcaebd012a8a06cb3b5

SHA256
80cd7370f4d8fea47edd9fe890e794a066ee85f38a4b69b9f0d9e54b29ab4e75

SHA512
92f06a425c171a8120d543650ca318508260250daaf6d06badd9216e8879cdc384489de72e375bc04e8c61d14eb0166a033d54c64c6e0ec50ab11c35b42ab778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b65f.TMP

Filesize
537B

MD5
dc8696d397e1167a94ba9b0d43d8395f

SHA1
e247c5f666c400dc11b3b27e628cf714beb11ae0

SHA256
3dd7b3d626330758f6aa95409e933b4e247cf7a713b6b9dc67f1216ede875465

SHA512
a163e485da014ca72c7fa0619e64388e506010d616c916205a148bb69db16ce169a20a4ce63cc7a95debe448281332ee321bc460f66c4fecf8f40944489ee461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
671d9a826c30637b34ee708fa12b88f8

SHA1
b6f3bba06c55a054cb149cf4130e06f50f5a8333

SHA256
e0eb5eb7fa69945a08385e6e3209721b1b1a6fe5e02520ea02c781cb50954f0f

SHA512
30bb6bd7a8271fd7c1b0ad0b42916858f214e05609d2f446fc6e54f473474440be1a47c5913fff0cd551760f43346f28f48e0815cd31843499d84bd0096e7ccf

Download Submit