71a77ad1f30a5cebf785fd203828bdeca5e4c9dc94a93ed0ed069faf5feeaa2f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc4e4a3647be2cdada0b95cddb61817c.html
Size

120KB
MD5

cc4e4a3647be2cdada0b95cddb61817c
SHA1

864ffaf8d4c48fd24365c86af1290f2f6955551e
SHA256

71a77ad1f30a5cebf785fd203828bdeca5e4c9dc94a93ed0ed069faf5feeaa2f
SHA512

71abe4cb01cb15555481c7d3f93596a263ecee19c8a773543331fb1e78a680240c55361a6e4bb25b64ccba4f6d6f08f161b6629ed3547ad00700df242d0fb5a0
SSDEEP

3072:l3k7zB4armwQULt+qR8poQItytVJBp8o+Xg9eUQtWu/GCZGj5oT/QiJhKtbVhutk:yzB4armwQULt+c8poQItytV3pJ+Xg9eM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
2236	msedge.exe
2236	msedge.exe
5684	identity_helper.exe
5684	identity_helper.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3892	2236	msedge.exe	87
PID 2236 wrote to memory of 3892	2236	msedge.exe	87
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 3240	2236	msedge.exe	88
PID 2236 wrote to memory of 4540	2236	msedge.exe	89
PID 2236 wrote to memory of 4540	2236	msedge.exe	89
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90
PID 2236 wrote to memory of 2152	2236	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cc4e4a3647be2cdada0b95cddb61817c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad6d046f8,0x7ffad6d04708,0x7ffad6d04718
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6621164663752824795,7505815667109468006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
22KB

MD5
30be678c3eeac810a11baebd8e7ca39d

SHA1
a7759bdbd6d81bda5addb7d297125faf8d162712

SHA256
b631fd3a2cedbe8626956c3f914a4b338372f77b38d7f477fb2a1a03873bc69d

SHA512
150902c52cb87ae836bd6ecf64a7940f86d7971105b6baa1a9f28239d439028ae9f65b7b0a03e846eff8eec5b861f328f12e2dcb8e209a26d4dddb5074360ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
ae4307ed50a30f6a7c8ea0e92d87728f

SHA1
0a8d3197048f964dabd1852668ceadbc302aebfc

SHA256
808289249f146c128ae7f847ebeab48abc45cc8f6516197d134c4dbbaa67d8ff

SHA512
966533c60b24981e33f596be8a64013edf9f932e9d48dfbd30fdf46aab44d8047593af9b88fd635b37f8312f9ee2c929b44a7ec7949bef5a0311a2c97707c3ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3a4d93277d81f81cda2730c9a840f086

SHA1
263121fd638350a687bc837066290e77376b5105

SHA256
1d5a2e3afcafc2ea82bb09c37892ac4be564a197413664661070b5fe3fbb588c

SHA512
010a762959f98078fe55ecec3682b4a47f8174ddb7973607c3b3876c8d7c5e3b5fa25f22573394b13425ecd93a1632a8f2dfe9a419cf0ccfa1a280aeade7c642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
57126476f8a5fe523e028e02e1d603fc

SHA1
9022252c57c03735b3408f42457d0b9220c1f209

SHA256
046eb0d896ee399b3a9822f4421cd18c3c46dcc2b005dc3d74d4fa0ab7a6c342

SHA512
f47ffba09b39dc3292dbc6bf396381795116ff8ec651ca1b6599964e9c889a678360c358948e740d22f4146e771c2b49651c610d70d806b56fd8af03b8fd53a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8edfcde26827a59e7b893f3bb4706872

SHA1
b272053604e8971cb779c25402af527a37198d41

SHA256
d43ad59009502508a453c0505a865ee94d671cc3f91df08195a93d0e6633f280

SHA512
b26d32a44f51ef8310181b61815353a70d6093547f8ae556c2036576078815828c04dae8b212d663b011f44c079941e14fdcfaeefbcab31ad58f9de343af57ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b27d31f9ead87741e080e07fdae10944

SHA1
50a34d4ea29be2d1e383c9e7cb01e1d47631ab94

SHA256
c28ba11769975ee3f6dbc0e6f9c4165b0e1322150a9e374d84b1bfc503564d14

SHA512
3d153146a2c43e900a060903db842f3d83ebcbfbf46c2086fd28ba9acd9a8013e60b383ec8d9c5f213efded3e5456a1170434d5de66811b4bb96cedf5a9d6559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a66ee79f1ba3fb448ee95eb041aeee4c

SHA1
91faa4d71212056fae5ad7c33686bd7e9384086e

SHA256
0565adeba906807c4767a508d103cb0d55298186709eed0df5f532879ab1167c

SHA512
d444a8f64c65b05de4e086f2227646580cf25266e77e10c506645913758732f41e58836f7071b689c339ccc249af5f73e752db69a1776de15724acfc22da1c8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdad938aaeee112efa6060c56dedb6eb

SHA1
50c73cbc0a1c9530bbebcca47fce788b2abfb350

SHA256
180ac059c00c1e38806295b446125e2e7e86d2148337124198d4b12a97cd1405

SHA512
bf77cd82d80063cccddb2400a72dfdd2bb057dabaa9c067b6bf5dd6cd2aac9ec419bf397edbfb219d54983fbf7f47eee9994bd4248f7b75e6bdfd12c861aac08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e5e77075c60a9d2605f2f90f14aa957d

SHA1
580cf08a0936240f4efb565daf9d90c12d242aa5

SHA256
7d07ecc16f37cf37a447a0361113cd1f074e9709a092a30d53ded059e6ca8bc8

SHA512
18bd7ac19e72e3c5710ff9af150531f3c2cb1f474be819abe325d9cedb4cd0dc016ea08565acba70d79269514acd86a7089ea49a78d5a9d86ffc21bf34f76eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
1ce35a7386ca6813a406b7cb5ca97477

SHA1
296481e9ba23f029a9289f428541e8bc25fd01d2

SHA256
2677f8bed0d1ae1234efc222f74d3ed16a19cd92d71032d6741d85e40398c852

SHA512
430e6e961b5fac52558f7404b6c2bfeee65a4d9bca46b00b37243b61fce37cf0f5b8c85190bd042abece752c387d48133813a414115deefddfa00b3387c9b8be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b630.TMP

Filesize
203B

MD5
94bbf4be55bef46cb2f2519c4185a6ec

SHA1
1a6e33e409b281b15b4c11a40e0e10d384bfebcb

SHA256
23cb2d28837045b76c17bbd3401ff63b9f39f569b258acce098ca507ba522257

SHA512
3ab2b8b8a8350d7a301f8a3e5b4948c50533347da39667a97887db098de36c0fea3115828f0fe84b0c2f45213de2b288d0be384cc14ce4fc8823341cf8996b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55ed01262fd379d0a7ae541e4b550788

SHA1
172d8391e8d6770e53fac74a460a239c4669618b

SHA256
90467dee8daf26e68f04a8b946814a6e8e956ba1ede23a0eca8bb5fd08b03792

SHA512
b2c32f5df1f7cc1f54c7a0c5404b6e7f551883a1f582e83ee3e10fa9ccad178aa96f1c9234b1cf324dcb21154da6d9ee7bc135b47a3cb7126cd26e7ee383e85c

Download Submit