e38a265ae35ac078377dbc7a7dc99d3d6fe2377817e5115215a5da50a837b312

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1e6a4f2eb09d01a86466b17b4602ad2.html
Size

146KB
MD5

e1e6a4f2eb09d01a86466b17b4602ad2
SHA1

33436ec63688ca5acf747811864d0edc0c2d0361
SHA256

e38a265ae35ac078377dbc7a7dc99d3d6fe2377817e5115215a5da50a837b312
SHA512

a65fbd74136473484c08a64f8db521d5ff30dd9e2c797dc30c7cbd5301d7ef4d1f46bfdfc7bc8e4ec237a20f44db1f2c9b1c8a19e99bb103822b626438f60e0a
SSDEEP

3072:DVGejtPUeUwIVGejtPUeUwMMKjxmjLZGDAMJJlzTPPA0ZLpfq8gMPhbi2zhkTN:DVGejtPUeUwIVGejtPUeUwM1iLZGDAM0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
1692	msedge.exe
1692	msedge.exe
3788	identity_helper.exe
3788	identity_helper.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2552	1692	msedge.exe	86
PID 1692 wrote to memory of 2552	1692	msedge.exe	86
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 3464	1692	msedge.exe	91
PID 1692 wrote to memory of 2760	1692	msedge.exe	92
PID 1692 wrote to memory of 2760	1692	msedge.exe	92
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93
PID 1692 wrote to memory of 4648	1692	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e1e6a4f2eb09d01a86466b17b4602ad2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb591c46f8,0x7ffb591c4708,0x7ffb591c4718
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16989333335090840396,3754915722087310463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5480 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
ae5e66ac8b195c2c828acf6e30e007a0

SHA1
6f1696a292ec0be3aa7881010deba59e2603d1c4

SHA256
5f13fe17d11134b5157bfaae10fc8d3b5726cfedc42a36c17b611f6a35783bd4

SHA512
2a7ed9fdda0ea8b350d026dea3f7905711546bf7fcccbe696634b6f438542c418c79848e228eabab13721c1166f384d4bd269650d13ee6fa5151ff4717bc0689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
31bede240accab966344e25ab0d6e067

SHA1
926ab5a7a0ca0893e6253b74c3d4e1e809f3028e

SHA256
f9dc854c5b1f2aa96e0aa4b185db8ce6cda79e1a98b0e16d3c1c39a4513b7526

SHA512
741c2a765c2657936717de058038d5b57446fa7aa82b38c09726cb2b01d069da23a5e790c52e0df6a5b088380bb374a3796e57dc672bb8f43061342544e2f129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f46e4d8648d340dce9d3608577196b20

SHA1
4ba44e328a7c514717cec002b20302d32a3cd95b

SHA256
74c5f9a786049c386253119c11a201ab04ecac2cce85a2060d2a24cf059e3d50

SHA512
ca319a4b8c1f2e2691f7e5a4599d40f266a009822c5b1117421a4e309a305dd873bca163b8cc62b2f1f6ca554553a52a8cdffcf16b11f9701e71c53e8cb32c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19953b2265c102dc7abff5004a66dff2

SHA1
6fc9fcfa6407b8b0259174b854d8a11f99dd9a9f

SHA256
316439c2339851bab4a082caab42ed7ab7e956ca470d8b1d48565b3dadb82354

SHA512
56f70bc683563c3496801d77d568a8ce27967383d0528a2b212b7452f1a2c80087e3397f0849e633c07ce75b96c2d45e860635b577b433e720160745c911fe5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
38d06591c7a808b0eb1164b1b69635ff

SHA1
abd738cf6abd235a90b0a2b79d96ca08096de4f4

SHA256
19648ec3789e84b46f037568cb432ecc3fc957ce4fb88368f56ce506348585c6

SHA512
ea2f324a88eb87fb0628d7fe82cecc357580878056fb7a7e64489256b74a9853c8c69e9d5de8e1f088cacde3ea735bdf5d6b1451767cdbdaebfaa90800156d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fed0c2b426db7db9b1162f2271f0dc51

SHA1
2260608e5d22a8647ceb1789533004e4fd6675e9

SHA256
c9fe15647bd4406a5b5635fe1f44a83e29d386b2d85bb6c738f69dadb013acd4

SHA512
688bd7b5302a2e6d82465930c2c846bbab25bcb997ec574604742e8f9b40b1fd6bcf2791922259859f86253048d348763430e57a786c51906a1c6fe4683cd910

Download Submit