hxxps://www[.]video-phi-swart[.]info/?m=742440236[.]mp4

Resubmissions

17/04/2024, 03:51

240417-eetxpsch98 1

17/04/2024, 03:47

240417-ecpvzaed4s 1

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.video-phi-swart.info/?m=742440236.mp4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
5076	msedge.exe
5076	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 112	5076	msedge.exe	85
PID 5076 wrote to memory of 112	5076	msedge.exe	85
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 2140	5076	msedge.exe	88
PID 5076 wrote to memory of 1120	5076	msedge.exe	89
PID 5076 wrote to memory of 1120	5076	msedge.exe	89
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90
PID 5076 wrote to memory of 3792	5076	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.video-phi-swart.info/?m=742440236.mp4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c39d46f8,0x7ff9c39d4708,0x7ff9c39d4718
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5316373920945421909,17235428852528921346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8d460879-1476-4469-8059-609bec7807f9.tmp

Filesize
11KB

MD5
7a0e924c6c9c41b05ab844a9cadb23a0

SHA1
ac0593145f21cd3e4a1a0d59f456a7308536ab56

SHA256
6a635f8e8fca266663ce78d7336ab37c8b4463a552f5f86dd73008f4f71e9de7

SHA512
ca7c651924e6eeff8698574c0d4737b15b6cc83c610cc62786d2089febb52cae1327f22b51fa7fb42a1ac7c5141f893d817ab3bd739954f09241c971a653ffb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8c91c8582b0c918416d14bd7eedd686e

SHA1
b2ff8149bc21144fdcec64111afda492965c6621

SHA256
1e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e

SHA512
a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2579d07b98bbefadc929d80fb3dbd32a

SHA1
1ceb57c4b81f0f23500e118a4b9a225116a467de

SHA256
b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6

SHA512
53522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
39KB

MD5
f56c6662526fb06bcc855531d07c8a4f

SHA1
431ef0d544abbe7a422559ac898b1c2a0f06ccec

SHA256
8558cdb730f2fa912e8f61272eca3f86653dcc38c86d97384e9850b58a7611fc

SHA512
69c03d6728e447982bdcd9c54fdbc5de3ed3574e461fd5159216c2533c2a6c0b4058668a0769ead708574ac2e218436e04b49ab6e3ad49f987e6a863e2cef4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
721B

MD5
a1a056e7e466fcbbee4290c8c6727472

SHA1
f58c9a6c9f125213bd5bf5e21143fd6d88a6fce6

SHA256
220461c0268f93409cccc7a8c42202fb01d0e74ccb9400e52406bbb8ea77d4fa

SHA512
aec3acdc6f1549b0ad33ea1e5c9e3032d774d3a945bad483d5303819e3f406307befec85356523e98443674aee79c27d70d1bafd096ee974c5318de2bb2fa9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da7c1f3cc65d31a056c9640c1395f840

SHA1
9951cb6b04b01413c8eac93cfad549cac5501047

SHA256
e798a5bcd6d522d71b5aee0ca46cf0d2f39fac2cf358c60fa013df75d99d3d31

SHA512
23f802c125bc7eb654843f54cd54fa48e1a7369aaed5336ff300bfe9488763311a716434243801e95db85980edd3c58944fec9ba9cde7e0ea402d9e1f377f674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
222c84ca6d3d7c286f022c543cd520da

SHA1
396642fa3107ba28f8f7cbd0419aacedce86e53b

SHA256
ca840883b3be5219d8a73eaf90bdf65339ba55bc2335b296c390de5220d28f54

SHA512
33ec78218cae4105842d1032dbb5ba6f1f91affb618eda2cc262a99b9dcdde9434108195c4651931164f9d931f95f55e7cca24340419fee6f9d59cd0ec2e1f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b08ed63e95e9b0f8462fa78edb5a0d6

SHA1
f8f644043004966beb5758890260eefdfc86fdc9

SHA256
07e3d7a1fd2615bba61c6fecd287e0bf5ddf1654ecb6704de1381bcb081cbf6c

SHA512
81abe3681fd586013713d7e83d189fa4a32fb15e7d9ac94331c009956cb01848826da0092888cbc2f7702f921acfa5e2c01e373f30ed5595d23cc0707bcd4075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3a328a922bcf1c4d287840a3f81ad39d

SHA1
91abc3c0bb1f294a9026e7a74e51201f68a792f4

SHA256
994d30f62e04c53de8e1a9f3aa2568d9c449081de73ffb4e00971c6b97b55dc1

SHA512
7e4d720caa063b716cba634965807e70a296f2f58bbdc2cf8a82af08e4d5be4bc894613386fd62c0b5f77ed2e38c62c1bde68bcbd99896b81346b24db0f42c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
774191f5090b2fbcb455c675bee89f25

SHA1
82e7a87d47d920f4ece775f2b37640dcba9d8c9b

SHA256
60e671d70bfa09e46c9c0973ceb48e28440f254444af28eb3dc24e0c6767057f

SHA512
36856a652dd762df4bd26af37776dce7efe51cad79245b87f98f1af56e93913a83e9fe20ea84bd12837eab569fd0779e3643ae998c4173317abf0f4459d6a7c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bcac921e-de39-4d93-865c-beddf8fcc8ea.tmp

Filesize
204B

MD5
7e77b3ab817c15b38cc8eeea0f48c0f9

SHA1
ea0a94dc3f3255425abc564310fbfe8c5293877b

SHA256
a013e0232e46601b4225df167795cb252e03d915588d6655c49e38134bde9d06

SHA512
84947548e6d9532cb1a99a04271894e56b4130629dde859d93a470d3c7359ce50db00a3230cc30885a3487a6f87945bd07d329cacc7b05507df60c4c2326a20e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit