d80c9a2b019b10f3f26f7d00353acc3d86305ba75bc7ba7d527ce44d62c0723b

Analysis

max time kernel
54s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

url.txt
Size

70B
MD5

23332d8aa9ed084b5b9ca32ef1c2335b
SHA1

f9b97c10480c7d1a7c8305e0040b4a592b126706
SHA256

d80c9a2b019b10f3f26f7d00353acc3d86305ba75bc7ba7d527ce44d62c0723b
SHA512

ac89cd9e562901323ab0d740ce3d28c05a8505eb3927aa68bb8f7985f241420d19bf719e17d33f39dc8740ed3f21d75c37c43be3c94dd9abc22fc065dd16a5d4

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
35	drive.google.com
36	drive.google.com
37	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3612	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
2516	msedge.exe
2516	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1648	2516	msedge.exe	86
PID 2516 wrote to memory of 1648	2516	msedge.exe	86
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 5036	2516	msedge.exe	87
PID 2516 wrote to memory of 1596	2516	msedge.exe	88
PID 2516 wrote to memory of 1596	2516	msedge.exe	88
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89
PID 2516 wrote to memory of 5096	2516	msedge.exe	89

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\url.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca7ef46f8,0x7ffca7ef4708,0x7ffca7ef4718
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6980631063050009261,6868615044761559027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
4017b6e4e9cbc4fa984eeb0a1add1e98

SHA1
666f38696ff2672d13b8b3552f047bafdf0a4f78

SHA256
7ce88a5b5a94c71a9f45a350199429326d6860f670295868c7364faa813694e3

SHA512
4707c06ad73b74e11c9865e0f546446d96721c8ed94ab44c9ba06af28f3e96bfcc8a0fb58b8d8373ad43780e315e206aaf7b1db564e45aa36bf3051b0c851852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bff447971c5f015dcea39378876a9945

SHA1
a25769388f787606f026c69bc8353d6d634f5979

SHA256
dc68491e4d639cf7560d6e25cb8cca055835d6c1269b2140ad7711b547d881c1

SHA512
4130be93d770d6578d86f05c1cebae82e80b2329f1d8158a55284ac1c8ea029ed737dba8582c2206a204c24d87a8d4702d3af98f946443077461ee337cec6442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2aad3caebc4f665985b1b1f5d4f2a663

SHA1
11152295aee92227b5a4321dc45e15fd0629a7ef

SHA256
e9e48cafc14494ccef39b33b1334c36906f58dd418451d581bf209800be1b948

SHA512
6e760c89e3d8a7a0919c98d447a0323e7a1b594aa15edf3c45378ad20d60daae85496309e8a5df0890d8e5035efb3505042dfbc6451a45161027db405510c8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37c3bacef2a6fec8fd13b852a23c4a1d

SHA1
b4093a663a9843be8aa92412dfe1f104e1309942

SHA256
d34cae4560ffe22cae3bf8f52f1298a40e449e866d4aab542020c0ba209e1512

SHA512
d5b9e207a214cc46d41b60f8c729ae71ac2c4d962161e5be8737bb704c0821b87a152c07670b309fcf9701df2632d4dd7bf7d0fa9f1e05c173a7cbd943a16927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9ee3e06b2c8774672ce18a6e9439b45

SHA1
25abaeee7a173f07b69f74392b53ac13408ead60

SHA256
5320c6be278b3828a74901e28af32a9467917832a23336d82fa985bb43aaee48

SHA512
6fbba2cfe5aeed1e146e4099cec939e5cc176236533fb5ec1c221d4799b302c6eefd37b8718c63ceec110b891d4303aca67d0c620fc942aba9264305d2a97bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
059a3378d6903cf5b2a78413d5bd57de

SHA1
d71f4f8b91afeb23a8c99f535756b0129e70c38f

SHA256
9b656b8c63c2ff05c37397dd2141ab4e74062e96eb09566780af9de25d8801a1

SHA512
ec2b371cd7bf3925e6a88d196de5cc8261cb2e5ba2f018950652389d25c628904220793f4b4a04d374e8b0fa79692300a3818f6d98f22c7ef3d4f464c61041cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0b13b17724eb3aee19ddb5021fdf929

SHA1
a66592703d0d79bb987d751b6891e9200394332b

SHA256
f43dc23b4cdafdf119eb70fe0fc03b01de68dd436162b741aa7b1193c69dfc1c

SHA512
38452e7e15e45b8852fe375a9e3ac94b4031942601dc01b557b449e9ccad7221f151200ce1f8644f35ef8ffc67f34d2cd086a492db3b93938154a2b146197414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1cc235bc98ac53a245514e1d2f28b8d1

SHA1
ec5c1d99ec36f4744ce0affe46ce735a971b9823

SHA256
f80092a2829012ebab7303f87b94af09deca2f2b56e7ca55c327593223b803da

SHA512
fe99a7fe38a46c008d32ba9e6f447bf30b4c42de43ecc0e75954ea474734e91e38a3cd3f4350fcb2b73fc3c241e80a3a2876393d2f7729301d96a26a07438547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f477246a398262a1410b014e8fcf4ec6

SHA1
79a61befade86f27802e4492a284845dae6ceaae

SHA256
9ee97710e7be6454da842448a9d92ea7bc9a64e46b11871a57e89cbfba440774

SHA512
cb228f62f8834f1c3e5e636208fe22b1503b4ce08c638fe7a30d82ea2a20e3285a3979ce913b11006128091bcc847bc307f179bf44b6a8c40507a2b23b9224f1

Download Submit