hxxp://html[.]eparthosting[.]co[.]kr/404[.]html

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://html.eparthosting.co.kr/404.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
3672	msedge.exe
3672	msedge.exe
740	identity_helper.exe
740	identity_helper.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3944	3672	msedge.exe	85
PID 3672 wrote to memory of 3944	3672	msedge.exe	85
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 4136	3672	msedge.exe	87
PID 3672 wrote to memory of 2920	3672	msedge.exe	88
PID 3672 wrote to memory of 2920	3672	msedge.exe	88
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89
PID 3672 wrote to memory of 3656	3672	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://html.eparthosting.co.kr/404.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c7b46f8,0x7ffd9c7b4708,0x7ffd9c7b4718
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6335832382562051889,16406744311584986481,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
22bb6af63c7710354ac7070e45ac988c

SHA1
34d29d6b316e39ed8fb8c5efb42c4269040fcf1f

SHA256
1a70d5d3dfc04e6f5cfec1ceb06676039229f895f30007fdb55b043ed48ab4fb

SHA512
42c12820b5237caa5b4d5149901f84db6619a69e85cb869df06e07b3cad1b51e0c2d0545ee0129cbc8e7947fd8c2989def537ad2d58a1d5bf2c2a1bf60041ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62677bdc196e22a7b4c8a595efb130cd

SHA1
bd2adf18caf764c8f034c08b6269d9693875f3c8

SHA256
b540616d7e73ff22642f4fbe2bea0f9daa2f1166391e76cf817b2a93e0bd41d6

SHA512
d23c3b9662eea6a75382242fb8e8084abc1127afbd2632f161df71a2aefaf223621511e1bf6229cf7e86313101a8d9dfe2f20e1c0bd481066e1969cd6fa75e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a265433efe9029596b9b2f3ade29f7a5

SHA1
55c6b829818e008772406d3e4abf492c29e46497

SHA256
4c79dd0689ac48f3399f143dcc1e37646341eca9bc17461d0598fb20fc8f2d22

SHA512
29440d9549a7f927a05397d7940fa21c1dcdf284a55118f3090a3db71c9715d25e4f717924c8709fa9558ab93a9c7d2f5d84102c3bac2d21f632efd62531e865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
530b9b3bef9975cc5eb0f66c9c33e975

SHA1
0a8de754c0fb1f28f3dfb1041b8083593fc75d72

SHA256
88ff9513aa8bfe67d95d5e081be92ccd75118ea3abae86d03608f0142222fe79

SHA512
89a682562d3490c11ccfb0f2e0fef658854f7472744cb98c00dbfa11277155ece65dd8f5b00ca1efa24a9bfb1428288b6371673234a5d650f91a86b655377a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b12a50fde8bc09409860c3c44027de3e

SHA1
e149c9c2d010f9a178984a6e4d5cf15547607d51

SHA256
1078651164f8b03a0490d28c203d0fefdeeab4fbdfd03f02ef36e728344240bf

SHA512
18d9aff4aa68f22129a0372149ffc6838a2cf1d99a6415b0647ef8c14888bc6e4048e56046eb44da48cee4032fc97142f5719b6263dbe74bc0b219609d7f722c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
404ebf533c90856b71b9bd60b9ab5344

SHA1
81163754ebeb40f429f76016b7a914bfec1ee194

SHA256
e3077d64d2bcd0c05cd0ae1d21eb1e6695ce12e2d0ca383d2152e80d79f7bea1

SHA512
2b6e62f9ebf73d95d1f03efb93fd86b540ef2b57c4cd4475dd4d9ae3660c51384a5abb6b662029b12fe5a30ff6eeef7e56da15724961206d44d27fbf683b4114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ff98dab33b6b05107d2bf635c86cc1a

SHA1
9e49a4f49081425e99eb4906416a0dd27f8036a6

SHA256
207a52a937aef0c151f461f45fe473c48737331502447a17dff56ec3a6128b3e

SHA512
a141fa4b166e7282ca937701479479d2ae98b1ffa52f0178c892751a656da2827264d7566edca058ed04166cb7a0dc93a19159c2abbbab15d33434e665434c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d1d05431726a33b587bcaaba4458083c

SHA1
fca5ba2ce38084d3801fca41eeab8439b09a66e1

SHA256
e1e6ae7a4826f8e52de025b8039ed8b12ae144fed23b61b8d830ba9936e4be07

SHA512
f9e263507dd23a35bc29eea2c5f1e83b881ef66277dfebf3a6f94079a74449c84a605d04a9d2825848d535a270b64bb0ffb3e8f28b2caf1fe7288209989a65c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38168b66448efec022d8aa1cb38199e8

SHA1
89156a550fcaca15ebe6e1a1fc836e1ce4c58b9a

SHA256
c283141562aed6731d83fbd6b868b5bb2aa7b999cce7570b87d10634e8703ced

SHA512
64ecfed0a23854aee61b5d4440a8413e239ab67945559c29c7e6ceee5a23e4c14fb9d9bce34c174e0dbb238059e57c4f62ebb78dde802e786f37dd2125441049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee6a38a35704e2b9dfb92820423d3bd5

SHA1
b0214c620eaef8385bba9c105e5fb5dc5bf69a40

SHA256
b893afb690dabe29aba7370527c5f8c61b0aad64b9e8ec5aa37e084aef71431a

SHA512
08ec40a0839b6da21156d7b63d558cdbb791f800c0b9593cf85822c00e28155d41748b9bc90269a83d61ed6291e6cbee725484d8d9f6af8a455ede513e3cfab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
562cbe113f2bb8d75e219a8b15a9ad72

SHA1
5123db3d29cbab8628c17a46ee2dbf7ef705c28d

SHA256
bd53000bf8de02b91b79cf7888a47dd3500f951c9f40a67140a7519e76f71e39

SHA512
bb34af7205ece527f905dee65ccf1ab6685844774bd1429a9d5084af9cdf8fd2091067d669ed5f3b4ed012fb315cee01dcfbf7df18d0cd519f3dc4d2b00c3f96

Download Submit