697a3af931d75411a869cd26a7116cec65177c00fa7a51a7610de9c3e9fe0c4c

Analysis

max time kernel
563s
max time network
564s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
29/03/2024, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Opera Snapshot_2024-03-18_153820_mrl-4408-smokey-sunrise-gas-local-paradise-mt-3279RC.webp.png
Size

656KB
MD5

d037028c4ac8b8c21782bf04b81bf1c3
SHA1

57991988203126625e3809c2eb456e98b752fb83
SHA256

697a3af931d75411a869cd26a7116cec65177c00fa7a51a7610de9c3e9fe0c4c
SHA512

2eda33fd41330261ad625ab1ed546ce5618853e278f4fc8771732d8cd04a6db81eaffa5c7a00fe7e8dab65fe0465d87102a304162600b78644d38fadaea2e587
SSDEEP

12288:5iA/kjvsP0R7P4KoLcj6kq2gcxh/dKKk3eMA8FdsI8di1xs+:oKkjvsPOjXoAjrYcxOruMtdT8dis+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
2004	msedge.exe
2004	msedge.exe
656	identity_helper.exe
656	identity_helper.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2364	1784	msedge.exe	80
PID 1784 wrote to memory of 2364	1784	msedge.exe	80
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 4576	1784	msedge.exe	81
PID 1784 wrote to memory of 3044	1784	msedge.exe	82
PID 1784 wrote to memory of 3044	1784	msedge.exe	82
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83
PID 1784 wrote to memory of 408	1784	msedge.exe	83

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Opera Snapshot_2024-03-18_153820_mrl-4408-smokey-sunrise-gas-local-paradise-mt-3279RC.webp.png"
1⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb32b03cb8,0x7ffb32b03cc8,0x7ffb32b03cd8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,11774686178729430090,10247235464477845072,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ec7568123e3bee98a389e115698dffeb

SHA1
1542627dbcbaf7d93fcadb771191f18c2248238c

SHA256
5b5e61fe004e83477411dd2b6194e90591d36f2f145cc3b4faa20cf7ae266a75

SHA512
4a53fbbd7281a1a391f0040f6ff5515cedf6e1f97f2dae4ab495b4f76eb4f929dcda6b347f9bf7f66a899330f8897e1ed117314945d1de27b035cc170fa447d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
832761d52e3535116d6f0472e11cc5c0

SHA1
f24f691db53e6a38c7eb54ce397bbd3b9eea2a3b

SHA256
3785080ce0c13369da3811a6f08faddcfb541da480dd6c46aae18ed364d3e416

SHA512
c5d86956f6318484ba9a04af6392ebeb3ef675bc2c4bdc9e06efba866f4c5e3b4ed8dba18e75588afc72bf401717be894485a503907cd806dd2b61df7f906d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9e055cd0d9c961a9b790011ab721b7ac

SHA1
55e884136ff360de6cafdbcb21048061375e382d

SHA256
cd9ab32490a6b4713f7f79c12c418d1139560810c73ee2edc5abecfd19f2c19b

SHA512
55f5d192144cdc6a265bb8feff3d52e46a7c9869e68109f3a40111266176424002a6c65d1c9c14af00a49f8092ad60da370425b8e4ea9fccc12a19da686b42f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
661819ae21ce1d66b4f2dd7d652d2603

SHA1
0848373b77f93a907f47faf6b1c9cdd7060071c9

SHA256
ff3b9977e273479c3577735a20242b40b6a7fabb56eeb1adbad8746ddb19e61f

SHA512
49a4613d40aec9beff847d08a139c87ced861b2d249cfaae18db4db1d3bd02ad77d97d32782c330726ee21c8405b65a92e2a24e675c84f85da48e48a27d0096e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19f3482cac88997bafc17a4e25037830

SHA1
2fed59c0db9c26f02e72d38e1c9b0bdd6c1a4499

SHA256
284c07b23046d7d5a964183511ba09c1d9bc42e0c141b6701dad6b002b06b175

SHA512
33dde7164fe19f1b6a24dd8c33e89ca58684576ba14ac67c6cdbb36221197b99caedebf8017efe422d878bd552d38805352045ba9a0cfcd328d6a67b64e615a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dcc00efd81f9763a1f0a5f70a9ae233c

SHA1
6c96394be1f4618c572815dd80a78ac7e7616f3c

SHA256
acd6c3dfb20fea4a2fab11cad16b20fcd9bbf3332e6731a23f8ab959494e4675

SHA512
e7e040d2ebc88551a61d82b662d6d808bcb04b507c262ba9306ce852c29f06fca08c758e1fc07345db1ba90d889c6a7fee3074fa0e78142205236975eaa7c6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af212a3f76102353404af016879a958f

SHA1
bc26f35879c48f9b72665201dd615052a9efb842

SHA256
c43e7056fe23fb832ebdb7527531bba0bf8136ed3fbec2f2cd8cdff434795fa1

SHA512
a79c92323442976370edfa5bd4200c046b7755e483aaf918f0702af746a5e95fd61dc838412d24a08cc34c7bae069e935eda9f65f5386eb73c077c3f5627522f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89d6de436e2bff088f251a8a2d390513

SHA1
4e27ca507de26f9f49fb09344ca1de11c62ae480

SHA256
7bca0eb96e383f10ca3051414992b4ee2e40401637e27fba9bb0149054b2fe90

SHA512
16265f9fe7fd23f86e17342b42bfadfdffceaa262e7bcc54ce035ab24621e35882ffc024c8caeae6751539c459ca6d4321f01e720bbbb978c7fdca6a46c8d916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
0ba15f72ffb0a37243558588d3e78221

SHA1
814bdfffd723f7de9f8d6d6a0bc8d85a9f275cc0

SHA256
3d0223e1f8bb35870db41872cfbbe467f65bf9a1208dcb4d4ad874e250ccc10a

SHA512
02b168ef9cc226a08955092173c3745a55b28faa438b8152acb90d3bc1d9f433de7d8341def8b452db1986392a59cabc7c69689ad00825c58371ca78021183be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ba38e337fd208df53a47f6ef65cc272

SHA1
b55be8e633f515bb5f76c64ab3f0ca323a9752cf

SHA256
c4f76d6ff6687eba1bad4004b68e5c201bcaf112348a54543aca0de968943564

SHA512
ec8771c13cdcc0e78a260ff80fb645a0f18cf22a45597065c7bfbe6c288b0a64010edb8cf70aebb873e03147d9395923a19b960ab63374746309551b189ef5ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74bd403e84941160c188e3d1c84f5466

SHA1
a5f6c640235f9a1b8944f6c8624818fc6699a6b9

SHA256
14de701f92fb0dab8286c03b0116b77f3ebd0030f7c568c420d999de32cb5208

SHA512
accd18d225801079b5109fb55e602fec831681c1fd0fec6513d1153e8938484aa264b69719a4954bba398581f007fa9accf6d82717fd30bd278341e15e7a3025

Download Submit