4bd208f974d45699cfc2651c38f35b204d5bae83146b7cad0887dc13dbc65039

Analysis

max time kernel
163s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d720b8df0f0fe9e9829bb080b87d392b.html
Size

71KB
MD5

d720b8df0f0fe9e9829bb080b87d392b
SHA1

834864da1a55c96f87fc0491ade204c53233a4a8
SHA256

4bd208f974d45699cfc2651c38f35b204d5bae83146b7cad0887dc13dbc65039
SHA512

9298295d0c806c20224ebb579a9b7256ecc016819206a48a0e76a9803b819399cd5f4bb92574dd43f3e53f305265f4b92ec8728dc5896a9301ea6af625dfb70e
SSDEEP

1536:/jwSzdAikc4AikcoZ9R0ElZIrx2WqK7drQs5ZG5SLvdi:7pzdAikc4AikcoZXZIrx2/Idrr7Lvdi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4732	msedge.exe
4732	msedge.exe
5676	identity_helper.exe
5676	identity_helper.exe
5260	msedge.exe
5260	msedge.exe
5260	msedge.exe
5260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1264	4732	msedge.exe	87
PID 4732 wrote to memory of 1264	4732	msedge.exe	87
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 3652	4732	msedge.exe	88
PID 4732 wrote to memory of 4224	4732	msedge.exe	89
PID 4732 wrote to memory of 4224	4732	msedge.exe	89
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90
PID 4732 wrote to memory of 4652	4732	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d720b8df0f0fe9e9829bb080b87d392b.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff967fa46f8,0x7ff967fa4708,0x7ff967fa4718
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4306259150585730672,12315947324592759576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
20KB

MD5
397892797fc3a893d689821353364e0a

SHA1
a007426bdbd5acf849a6f3ba07f50f11efe122e1

SHA256
1cbc3547219f57ad6c23de13f412c8ee76ab28641ea6c1725061333962b6f088

SHA512
082cc29b400a5c0c9cb287d82ea8ceac1592656e585c4d6618770a511a5623a161f885dcf80c78e4ee0d37b56ee0f7da8fe983d3c54cfce6b397af8d953eae51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
44KB

MD5
c836019fecc97d15d849325875cabb0f

SHA1
ee5e11847241e6e8e4d4aab3131117a41c37ede1

SHA256
19b5e38ea10f052b4e709990c7bec4c7b97a4fb061f28bcb95b092b753d01d7d

SHA512
93c37c4236f9a5e9a096fbbe25d3a7e9977564d280f1afd175d0016c7334b92d994d32c91f2bbac87ce91843f2388e3048f46ebece7ed5db9d8aeecc681475d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
0ab340a760844e1565617f113a985a07

SHA1
8335dd72d9bd0c87a324e235ec38d0bba591f8a4

SHA256
b7babd0c4946e145871b1d2aecc2d1ced0e01c0bb5f039d822c0ab4624c9bcf2

SHA512
a3cad6ba985e7f9e1f48bf03fb41456e31fcf7110a292f38bca968dd5dc6b82083addcc5e0b78eba2bf8e87c521439993a1868f71d8afe2850199db4115b719c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cb7c69835e61b7836bc76668d3e05801

SHA1
a2e3a4b9e96a56b85086509f20b5313542959904

SHA256
fbd180c926f6e45faa5fe60f43d8ee92416a797a5a9126fdde7c5d0a42b19880

SHA512
bf5f2b8986b35c81e75bd039194cd6ebe35094f64cdca06e63ff7d0240536e0ed940317a4bb190c40f2d5c06a721236886d3cb9a7bb30ce790eca2a2a0213c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c00bbd78c3e272442531a67ed811943c

SHA1
3b85ca6a9f15d78ec0a81d5971b7ba91141252a0

SHA256
dd20e41154ea214a02f5b1fe858ed848a5effeb7bd46c4ccc53a34122e8afe37

SHA512
fd1aaf6eb03ffab1f672406fb68b24e98b73d8f9d3b934a53b5e4e125bec28bb0595efc6278886079ac97fb1c512a35115e9f202c7cc86c7ec5af0f0671241a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82890fd55dbdf8da3fe913a45704abc4

SHA1
f2336e5bf601a06761545f5f69871b145d6fadb7

SHA256
797872ba4e240cbf0f6a379d4b9c8d518d1a11f3180a802f07add2eccd13eac1

SHA512
710e72f267366df748463e4a27c6efe156acc52fb7288928a6a310a03eb5131a69863364d67a7c7ba67efca5c7a390faa84e2d14140bf9e8353b157264efcd20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6f5510b5790b8c20e07824812cada709

SHA1
3acd15d8c33cbf4840693f7f83159c6fdcd875cd

SHA256
0241c4ee3499f17f1fb6d3c84963d71cdfb9190d98fef1c214efd9a5b38a150b

SHA512
76ed29cc48e2dccd2d251321f1c31c07405ebf413bddd2ab9f9b8095d3b03696a7f49fffce40e0a40bc1ed9a4e78e4a2c45e6efd12486cc603f37b0a9e72068a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a861b1785433d9fe780123981cac4f0e

SHA1
5ab47200326ead2f66784f4fef93de0ffec5aeaf

SHA256
af4920cff89d5eb3fa306ff8505fe843c10cb95f1fdda3bd5f361362a015f3c8

SHA512
08f5c7950f6d1149486423746da3163aa17094dbe4660320e48e86d796ae37b2c24c609b28a2f72fb93f2d23fb4fbfcd2eee7ac39ff8ec4fd4033bc8e0cfa221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8f2522559d6020e363de95a00013250

SHA1
20d09e9b00183abc627f0dfc404d208fffbfda78

SHA256
3ebddb0754063abd875e592372aa713c68a94ff1f006878f8a77334a23f6e70c

SHA512
7fe1ca2844a0e07e4b7baab23211910b31faeca231a425ef00289e335bc7de68af69def388266066c462e294bc52183eaa3f89f178100b45b5cd53b6c74a5c04

Download Submit