75da87e6864da1cc0ac0777a1f061d1c9c11f9810c92b3503f284d02e5187f60

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7115d1cf53238e3b70dd789f1ae5f12.html
Size

98KB
MD5

c7115d1cf53238e3b70dd789f1ae5f12
SHA1

ac85c6378441529680055c15b4501914b6070ec7
SHA256

75da87e6864da1cc0ac0777a1f061d1c9c11f9810c92b3503f284d02e5187f60
SHA512

648753a1fbf3ea0ee4c3da5f0e6fdc62ccdb93b30f8b7e2a47526f9df74dff895581ffc3d409889152090a661509b7fe97ea607ed98244a8f224c1331cf9b593
SSDEEP

3072:NxjUavpzLE4ZMEPUyHpCYDcJHi3U2bFXa:NxjUikyJCYDw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4584	msedge.exe
4584	msedge.exe
5852	identity_helper.exe
5852	identity_helper.exe
5500	msedge.exe
5500	msedge.exe
5500	msedge.exe
5500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 5096	4584	msedge.exe	86
PID 4584 wrote to memory of 5096	4584	msedge.exe	86
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 3944	4584	msedge.exe	88
PID 4584 wrote to memory of 4052	4584	msedge.exe	89
PID 4584 wrote to memory of 4052	4584	msedge.exe	89
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90
PID 4584 wrote to memory of 4300	4584	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c7115d1cf53238e3b70dd789f1ae5f12.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecbe546f8,0x7ffecbe54708,0x7ffecbe54718
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3933343837783102218,8354889226415797850,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
73c8d54f775a1b870efd00cb75baf547

SHA1
33024c5b7573c9079a3b2beba9d85e3ba35e6b0e

SHA256
1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94

SHA512
191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b206e54d55dcb61072236144d1f90f8

SHA1
c2600831112447369e5b557e249f86611b05287d

SHA256
87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b

SHA512
c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
22KB

MD5
30be678c3eeac810a11baebd8e7ca39d

SHA1
a7759bdbd6d81bda5addb7d297125faf8d162712

SHA256
b631fd3a2cedbe8626956c3f914a4b338372f77b38d7f477fb2a1a03873bc69d

SHA512
150902c52cb87ae836bd6ecf64a7940f86d7971105b6baa1a9f28239d439028ae9f65b7b0a03e846eff8eec5b861f328f12e2dcb8e209a26d4dddb5074360ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
bdeb4d6c52b895a51abee41050d1f91d

SHA1
e24aa7bec51b6a8dbc386eaba542c3b7ee4adc04

SHA256
da75eb303c4d8cd06b3b946a10981445bc2b57de57b578ecfe4c2398cd843426

SHA512
7699322408bf5e38d421e39cc1b092da7829891209c573363ec18ad7165eb99ab46ecc26153c40236da553454f78ca17405a70d8110b537eae51f501fb6bd125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
87a34a914e569e180a6c25e7a6e27de8

SHA1
695fddf99464fbe95024737968eb711c3b41d0cb

SHA256
31700dd71b31ed56964785cd0561516d2c0b9bc162ba53854a8b14c88f41cfed

SHA512
a21dcb73ae32db45a47969d9e6c46597ce52fc4d8935974eecd965998c3796039c893d551b255f69077868c6fc5508be8911aa701ab44be8a3fb70ed0d9f72f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4c0723dfab268047567f5bd31561dfde

SHA1
084b84abede376564cbb6401996b702883c8f6fd

SHA256
f19e903fd918c054e547f36b2b10c3ebf09e698d5024a84ba2853c3734152acf

SHA512
22096e469d70274feb08870186892b60d59c69bbc98536714f9c5a954a3bc111d267ddbe313c09493ba015d5483426f60955188cb6b06edce086759e149dd5c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
894f8a040d2eab1885c26bef6f173316

SHA1
3a9f20b37b8572e3f5dfa22f0a80f057b869ed20

SHA256
e3cf2f119eae684df54c95f7f4853653ccde7c4ae73150d26c75caa3767f6e7e

SHA512
ca117f9319555cddb4daf6cac5bb332104c95aa02f428d661e9db5c555c6f95fdd2832501d9ebcf32f53f6993f7930b3a3265fb12d37646f194be46c9a326f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2a841a8bbfb9a3ac1d034c6cb9e64b1a

SHA1
41df51f59d4be1d0297a585e3e92d23321edeed7

SHA256
8a497914ca3bd7373f1188d0706baeae1c3a24de56490a577d94d845d0724ca7

SHA512
f032481da367b5f09fe01dba6a7bba8d2a24857b61c98720a3873000c89a3dc5d76827e67beb8843af3269c5801c350f0dcfe7c79a50eedc40ccdaf1b697f056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8c13ef3e79096b04e6d2daa93a04802d

SHA1
fe7c0a2d721f31574e7e9dde0ea10e2525bf9f93

SHA256
7c9a854c80b7362f34bf09e7b42dee03f67ba88eee2c98b42008911fb859d5f4

SHA512
b283c669d537c74f45e094ab5e6d628e9f35cf0ffa894161f12bbb84d3704a21721389d49441d33cd0e41fd59f853ee982c5ee64c9ccacd8fdf680d0b5d0044b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
987706afe71a0fd8031d28af8c905e90

SHA1
94537c75116c8a968e06c7f64cd10c0b4322a34f

SHA256
28ae9ab533e235e6b22763310b4c33954fd8d8e4d486a5f7669eb2d947aa90da

SHA512
645d98034974b1d8644965f8a57dd4822b9c4d66de405c698657f9a45bc68b0dd849b271b83a6f363f5dd6c4a273b4a07d75dbf2478c5f0bc0eda2ce52435f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
b2f6092bcb451bd58dbffdf618138b5b

SHA1
f766ea3ebd1e1a62825522ff9c5a594d0ea69340

SHA256
2d7ff5d9825bb0db2ddcbdf9c7c4687316d8bec83dad2bc211fc8757e7924ea8

SHA512
5935ad47a7040e53cfa477a27ab993607cc05990d314d965bab18918cfdee9349b63add926754e70da47da9414ca69d6d6dc61e70afb470ff9a0c92123d66bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58118f.TMP

Filesize
203B

MD5
48e8c9d8c5703aeea958aa9875c4edbd

SHA1
95eeb31bea3b68392859a7f5b6c13a73d1d587c3

SHA256
2fca13bc54d9511a4327231230656b6a26e68505cbce6619987b79bc69da576f

SHA512
83f5c5367fc84df18b85845b80a1dcc8d35904c84ca4545b9ff9eb3e4afc935aaf1f441bb8451e24750c8fc69f5faccc79cb3e4bd611380bfb84e0f41d27221a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8869638ebf07479f9ca61e627f8b0cdf

SHA1
df47c9458e3df1bdd11325fa9e7f59750e7e693a

SHA256
de13ce09ed4b9cf7c623b695f57cc5d9b92c5c1cbc352228f00595277b079670

SHA512
bd4242292aef673a8f128f5f009eb17fc003a9afe78e17b9278f60abb7c95a3d57f6c176aa08ea1898f990c6a1a28190194242c766ead2c0127f86187d29ebe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e75702f74213f5041d6f7c5702fc0ea8

SHA1
9f8bddd13b01d2581b84c81da1a750d68110cb6e

SHA256
17fb7f791ae6c5eaac5e21d704cdaf6475a453f702c2a3375c0d6500c88049cb

SHA512
e333bad728a18d9c5bc7b91c544536fd16b231fcf44692d75d41c8dcb5933eed6d9db9f669afba01b47d39cd3d58b89b41a149252c4d182f154fde311ee7688f

Download Submit