992b0f530b0811cadea8f040f406d7fd7a476d0a59ea4704a45ca75c8b68ac2d

Analysis

max time kernel
44s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

login.html
Size

98KB
MD5

4b605aba6e0c3663d0f6f0ed38a9f7d0
SHA1

21e737862d9932a56af2f108b315c04c76b14c19
SHA256

992b0f530b0811cadea8f040f406d7fd7a476d0a59ea4704a45ca75c8b68ac2d
SHA512

9522cce1522872c4533b638346b992c4bc7692c0e1b6828d4a826e195419419a4cd43afb411f25a1566971f3f7ebc1d34dc3f6dfc6b5e1e076109d09e0ab3f23
SSDEEP

1536:4Qdo7owMdTOKs/4yIUIX3vZY4VURyuCqiam5O7x1RBgowi8:4Qdo7oh8Y

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3726321484-1950364574-433157660-1000\{E4A2F8A2-57AD-4E86-A3BD-4D82F67CECB1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1592	msedge.exe
1592	msedge.exe
2376	msedge.exe
2376	msedge.exe
4732	msedge.exe
1584	identity_helper.exe
1584	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2380	1592	msedge.exe	84
PID 1592 wrote to memory of 2380	1592	msedge.exe	84
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1760	1592	msedge.exe	86
PID 1592 wrote to memory of 1760	1592	msedge.exe	86
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff855746f8,0x7fff85574708,0x7fff85574718
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5876d265bea33c02aeb931e88662cea4

SHA1
27b3bba1173c5b379b59881499892d9f8b483cef

SHA256
f0057c7385a7dca0f7a03096dd0b34cd32ee3b0cbf72336745909f698bbf8c3f

SHA512
0823bbced79bfc492e5156a25e07c47d43d602d36e055477d642b097c951a61b6f61345d12a66b3dc88a2f1110fc1bd06e6ed35142d313721a15b8803efd26e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab229ea5019759b07c70adfc504433d7

SHA1
676430e978cb9fbc382527586875ecc2c4be1f76

SHA256
3a29c881f6f8be6e390c858740b53d7126c3edc78b82af996b7cc9123811eb61

SHA512
cba4e718da639b16777f0549185dfa7b13d35021d0b01557fcebda14f517efa614cdcb3ce460fb6e5d9e23fd663320b60ed5b69f01d41e166c02dd8fc22ee64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba6967409141f6a23ffef37619aa3e23

SHA1
a4d0315c5ef6ef606bb5ce09d39d1c67f86e8eee

SHA256
60c1431a67f6ceaf5a4e5b622093094f99324e5f413e4197596b6fce35ebfd75

SHA512
287f98e128b7caff4faff46caa6cb99345aa08a84adb0d3132f262bc1cc86b1721ef8b9ae1ff7757012a9078c30fd5b8ca373cb38e2b36fdde5a4e3fac4190f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d394eecdb808e4f8e39b2bfdbf62be52

SHA1
1ea47b5c96e6ca33a71dbfb518de07ff8961b95f

SHA256
82f45d9f56234d4d95af9569d47d46f087fc834ecb1f33c66c24f4dcccbef888

SHA512
2dc8677321da2b0aa7fc6565164141100e35478be1e0aefb7962c32f70741a2d9af7aa5cad33e4c184946242b76a74a3617d4237de48fb2ac8a51b1c5674943a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
105347720486daafd764b4f6ff8d6264

SHA1
72188b6cea38007c1fcfebdcf01e48482993fd51

SHA256
3b8c91c01ba1268f6c843d2e9b2d20e7b6d2fdc2a7d802eb8c262827853aa41e

SHA512
c1a5c5721ddc765a62db62468e40df5ed96e53218a16aeb72b3fad1bee452e3b29baec6d5c0b104a206f6a8844aae6d3b17a5c1bdc0282db7586b1e6df6edf7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
86e5f0d1d8ad4fd240fd01e270047c02

SHA1
9b2e17553b93f01c6063cde1f35a30c12700a8b5

SHA256
e26a5becbfedc2b068a2e843c311ed5de7cf4b9cf757fbc33af24e43b9f1093f

SHA512
41416c0f7185261c3f9fdd1a2806a69b2c76e1d7868580067b237acf427d51d138d5dc2ef72a2d63e063781e2af2098d6e8dd3c70937a9a81ed676a0ee6cac2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57973f.TMP

Filesize
371B

MD5
a898929a08c48df3fceccbbc70e95fad

SHA1
fce4c0dab79fe88feb24348818146bc53c72549b

SHA256
dc329ccb445c04d9bedefd7d3f83a470fcff1e24e4d1e3eb734501b4b74c0dfc

SHA512
9500ab0c6b0bb48b165ffe6b35899a195a0236a755c4dfc12f8ceea68c8baf1dc90572b92057b213ac118dc5f7247c4a8e2058024cd7d616d8e257566c7449c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39f530b1712b266b5e2bf32c90c0d6f9

SHA1
fe2959cd8b0d1412c5d83ecdc3b35d60601b959d

SHA256
d00b565fde2af6d04d79bfb89fc9b5bbfeebecbc0e9e0fc9b52579428ad77ccd

SHA512
34ddbe7c4fe87269d3261f6ef303de0925b697ff03975ece4fb651b42ab22e54b1c246036969991fbbee6ecd4f4e71469d7a423064e65d2052ed0ad6a9be4e88

Download Submit