1c9a848e7d129ec15f889164a384698ec5447d817176036828012436e7268379

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d66fd307fe392e11d9c06ddf2809e135.html
Size

25KB
MD5

d66fd307fe392e11d9c06ddf2809e135
SHA1

06d39a2dda5c85ee59772d37eef06dca0ecc6fd1
SHA256

1c9a848e7d129ec15f889164a384698ec5447d817176036828012436e7268379
SHA512

0ff49bb456eff65e6d5d25f0ef0a923f9755930a7038b3fb86b5375dca3deae91402d6b5061f5d3ee00f1707627aae9884e0e2837319fc0754b621519fe2d7a5
SSDEEP

384:SwgMDGfkA6o1bIDuQsQghaweBrYQOiMDp4vf8HJKf2OroT:SwG1bIAQJBR22oT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
608	msedge.exe
608	msedge.exe
5500	identity_helper.exe
5500	identity_helper.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 3764	608	msedge.exe	93
PID 608 wrote to memory of 3764	608	msedge.exe	93
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 3744	608	msedge.exe	94
PID 608 wrote to memory of 2636	608	msedge.exe	95
PID 608 wrote to memory of 2636	608	msedge.exe	95
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96
PID 608 wrote to memory of 5064	608	msedge.exe	96

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d66fd307fe392e11d9c06ddf2809e135.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc52f46f8,0x7ffdc52f4708,0x7ffdc52f4718
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7295231417335986639,11116908844709015620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9211f9f5-9107-47fb-af22-2956d84d2398.tmp

Filesize
11KB

MD5
79c6b5bb9a23464a4a94f332d371e125

SHA1
28cf76cb7ea45fdb234252744d3dd68a34f68453

SHA256
5ec798fd7b6959fbfe4ac631f932630149cb165427338bf9a10b0a71bdc13644

SHA512
051d1df35b0dd5366694d9cec2d3cb5eab289258e007a450e2f95a5cf6a9f6d0b63a1e51312097085c7089cbd7cb3e6bd4948e71f8a3a95915c7d16d52cf5ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0e50273a54422f0188238e9661cf1add

SHA1
a7263bd2d0acf663d6ecba19c0006a3354b90a96

SHA256
695de618e06c91f6e5016b65d9547ef6fc8ab0a1e4480e5beb466e80c7e7d136

SHA512
002472a7afdd3205868e7d53f4da8d82da7f54aa2f72e4a8779f17ea4eab94d96e4c69669de1ee99e03cead257825c3eac1b5b2eb38d41d103cf4767e7ad75be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
be319f95c410703b7168da55c460fa41

SHA1
4bfd145a8d296c13f388122bc07bcc1dd30abc58

SHA256
c6c334bcb80ae49eda5902c75bfc4989edd565faa9506ca512f0457fc20d5650

SHA512
14fc75ac61076188f3d98f3e73331189db73d12d7a7c6f123b259d5a76332b6845d8dc82cbce55c77a8f5a5261245f6b807224e4bba47bcb02736b842fa9b7e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30d14da769794952833a2a36a09323e7

SHA1
58bc9f5b50a997f6c250c049c533da6a6f0fcbfe

SHA256
21c0359d927b632197115c699319486506f6c37a36002d1f47d37768afddcf28

SHA512
25b112f0de7341e99ae86bc77f2350c4ae32ffe65373a921b2ff729baa9307ecd75238da835b687c3d860f61d7b1884e3e31ee4510815aaec72da1fed94c9a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0746ee568cbd4ee544f362e2df0c83c9

SHA1
89178e5033292e8319e8af2903d219075b4fde6a

SHA256
1701e8769df9ca299c0a6a966c2b2fffaae1575b2bafa6108e63ef48ddd8689f

SHA512
aa4fdfa453b20f15a421cbe8c19e72374dbfddcf5529119e0e58bc3d7144c4cd6bbeb135bed73600330133a2f350c4bf45d730a04649fe03a1a5ccbb56660fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42b0054302a35b0fc24a63538e078004

SHA1
f4fe99cdc439120dd61da40193da77b034d4c772

SHA256
9bd6fde96282394fbe538c1cf6542cc9a68db41eee9b720925a725b4bee01d91

SHA512
756d7594035e6cc22801034acfa98968f315aa1c45fb80796984d8a44c3a250910e4dad5f1a0a0a2032201e70f8ff0e3847d0c7f773b4c862a6ebcfe99a532cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit