d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Analysis

max time kernel
74s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

country.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
2500	msedge.exe
2500	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2124	2500	msedge.exe	82
PID 2500 wrote to memory of 2124	2500	msedge.exe	82
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 3816	2500	msedge.exe	83
PID 2500 wrote to memory of 1484	2500	msedge.exe	84
PID 2500 wrote to memory of 1484	2500	msedge.exe	84
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85
PID 2500 wrote to memory of 4804	2500	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\country.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad76e46f8,0x7ffad76e4708,0x7ffad76e4718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8082415634574422562,6090057079343945757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1524 /prefetch:1
  2⤵
  PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0e30af6d-7b1b-4da7-822d-ebea9762c6c5.dmp

Filesize
3.9MB

MD5
03acf3c02a2f6f3526b137b90ceaf380

SHA1
f4a255430de6307bcaf85cf99062bac9331f85f1

SHA256
288f0e4cc4f91d60aaff7aa86b4fd3e8e84845812bfb976c6ef46d9bdf0d4ebd

SHA512
8080a70844363e6a2c21ba69cda731edc56dcadae84c506f6a2c0f077b6fbb16e833340284198ca7a3002f024cbfaf8cb2b684c08d7ff902822d4488b00557a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\422d0735-04ef-4774-ae5e-e96575ee28b0.tmp

Filesize
6KB

MD5
3b470726a83a3ffc2512d172df5f789e

SHA1
251f559d8a9b9056d29ea75b4857a3b11e52e4f1

SHA256
71e4ac6ab8e66c72a59dad347807b95ccd078c43ef34631c14387383b6704c74

SHA512
7bebb5dc5edd7bf2ddf62bb3348fccb740b6db94635cf7057566818ed9227410b3a5dfb7d5dd3ecbb281487cec419e5ebc40209480a5446f866cf08ff4efbcca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c2cef839916670aa072348fe60d342c7

SHA1
4e4b33b21e2c61f025672a9e3d24f2ff7158079a

SHA256
67aeb6ea54fa580f66d64be7272ba6f614bb571fa8d77c49d79bf299870b9b54

SHA512
962985e857dd6f4cf2c8a6ea4e359d150982a68485544e4578e38ff054fc8b9e773babcadb9bc2dba757e5048272746a13eba44fa37a8a9dc74590c157a00c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
692a747ca39ecf7f526949e376afb692

SHA1
826a4baf447c85b334999913cc469591da6f2b1c

SHA256
27e4fb2f4e7e78218b4d72b647b26504e6670751b2aa379aee06e40b53a8fb31

SHA512
f15950cac1fa580551087572f3733ef7dcbcde87b2f08d77f84491e2ed6db4ff67cdbba94eb1ef2fd45d665d7f6936674cb29b1f11e4b4ee42db5a0b174c8a73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
600c1afda0c51c6202dad94fdf47db1e

SHA1
bcbd2c9d206f8c1e56821a64e4f132029a357ba6

SHA256
c83aa6796c2ec050d1f9c550668ae5cf42ea2977eaa0330cfbddf05b27f07bf4

SHA512
ad0bb2165b3f31474b087dabccbfad89b3f69efa00223c34fb207c5e1a895dde60aa5018f791de9a1b962d970d9d5ce0d485756d72bbb1a76afcde3a0292bbcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19188837922012db4dddb67be07c2c98

SHA1
a8264678bef5c52d011b9ff1e929d6547df583ab

SHA256
f2d53afeeb473b8ec95f7f35e488da4f7551334e2a30fa24e8508015b2315298

SHA512
7221506917db4ce3c5189a3786fec1370258a51f858dc5e2a7426fedc4411a12fd70cc773f3a1ee609ad505a1c7a30b21199b5f4284308f3d5d8c8831ec94cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4a8db6a5a7da74912b82832b24c0991

SHA1
54d2a9e9ed59e47e221ff5ca767842c2f1f9d2b8

SHA256
16b7b1309267545922a59cb5d4f8fa06d2c309f32bcfcffa8c3079c5967e8c9a

SHA512
fa9b098195154d1f433de1cf24c14d351b0b912cfaf123640f9cf5d40838f4e7fbfb1e8e1a09059e24c1bfef7388130abd3a4a5ac0cafb875c9e0736347f513b

Download Submit