hxxp://google[.]com

Analysis

max time kernel
900s
max time network
1167s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{B346BD6D-13BE-43A8-901A-D93045A721BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
3568	msedge.exe
3568	msedge.exe
1188	identity_helper.exe
1188	identity_helper.exe
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1664	3568	msedge.exe	80
PID 3568 wrote to memory of 1664	3568	msedge.exe	80
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 4080	3568	msedge.exe	81
PID 3568 wrote to memory of 1588	3568	msedge.exe	82
PID 3568 wrote to memory of 1588	3568	msedge.exe	82
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83
PID 3568 wrote to memory of 3996	3568	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8178061345541391474,3060278396645127304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d24d59225276074bb46a65d8ec97c14a

SHA1
87bb643e5caa2b70c07e5b5f18ebbfbc868b02eb

SHA256
0669d637f6456e9a2e82680ee51ecc1b2481d9c774179a89937370abfada6f92

SHA512
eafa6c47b91097309e59d218aaf2f83f527621276a5dd4fd8ef37a2d07d180cb4aa921332c064fdfc76e1617cc805d3708f9beb5424e8c318732605129640341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2e7221dfe23df8d1d6444c286fef6d27

SHA1
acd7e3821b747983bd8d334f143a7320e4f1593d

SHA256
1de5c9ef813cf4bf6f62f99aca6455b9034308d73d1666c696297acfdc30a9df

SHA512
efc8c83b64d34ce6db6fa06c68cd25cefe6e93dbbc81d85a23af22bbeeffe4d1bbaf072cd2e090d48340da0755c0476c5dd35a6b0ebbc8c42387e3dcd9a93b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6756afd9d8c809663008949c1beba09a

SHA1
e243b803baab354f5c1e15e9cc5f9458d3e71897

SHA256
fc40198250e98ab6197c4ae8930b47f498b1d22bfe2917ea48caaf2712c6039a

SHA512
c347bed8a108e4737789375068220cd8646ae96997a0d5add6aaa3a51320f3bdf486228586973dd6156734f978a1b7cf9cd6493f6fd83141e497482ecbd76f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b8a0dc02cec8286d8d3a6fa325f00fdf

SHA1
27c1792f2f0bd4c3459fa1ece5615fa218e9191b

SHA256
80506c8f7418e2e3092c76be3ff1ba41479204527c3696c9b8907f8c072be38b

SHA512
96b5fb120a268cc87b73612639f127ec0c644485d8d7bd141e3d85cda14e0d3564e590c4bc5a3377ba1f943e33082ebb1d66cdc25f80a667157030edb7080731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da8c9e397b101486d4965994e560b7e1

SHA1
0a5c5c7a00bacc627d6df9df0d7d032e12fd8e0e

SHA256
44cee8c471368d5d793672ccabfad34141123aa6e59b4dd05ee18997ad521e84

SHA512
b7273efeb5c72d60f5f60d32b13a38d5d5bd068c3cc1f1b0cda22e82863092c0e6d390f905f1d60451997023623150566fc962976ab06736bdad28c1f7583e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3a5029662fb50070e170f027c90c8da

SHA1
473e8da9331cc52d605143913e2f717df493f574

SHA256
5037c33164a6723f1b2a039cf384356fc30b24853c31e75315cab278edf6680b

SHA512
30c9a26419dcaf91c5803563c309d8c39a9ecd992b3a8abd53f15809e3a60ac55c7cacca8256a0d7f1fb73f625f564574207af7a3aa023874f6f4dc43c029236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e364db2469ca6c5f632aa7e322379cc1

SHA1
fc9b1cdc87cc7d235edbc7d7cefd9a61c659b56c

SHA256
8a7ddf5c019b1b4f8e8ce10c44485a3945ac08e6be557c668a4ef30fc928bd0d

SHA512
68e78136a6bd6743da76a001426ce9fc0357e51b28fe0c871ab77de40dbbbe4f02e53b737690cd331037a5d4011e8addad8b77f561564bf6aff97a0a2986f04d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
7c17a64b24e136a285641dfc31b28cbf

SHA1
963081785029051bc8758cecf426650ccd279677

SHA256
f68fa50fc89093cf26d72204120829830be9e52fc61be44f29dd95fc214db9a1

SHA512
d4b68032f38e4610d496de68fbaf60664486e2029522b201c815aac1bc76da5aacbc4d6fb84f5e8659465d63d7620e70f8b92bc5e20df0f75a89fbf77fa0f1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c822.TMP

Filesize
204B

MD5
fb64814e6756a31ab5e944a9440d1c9c

SHA1
9cbea33cbbee0fbfb4321004969ea5fffc78671d

SHA256
4f700c0523c650aae569194d15ec6a01a1d2dbfe0f1957cda971aa93588d5849

SHA512
e6392ad11f556a67cf16113b9fd0698945214751cc35480e42f57f82a3e4191cb4bc17cfd8ce86fc6d5f70c3b18680cfe9c99207f3e1c4bea0a148e50455a89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68697099d73370ca60732f4398c00177

SHA1
69f9c3cf7e25bc84144e3341148d25ad86cf10b3

SHA256
261d32b4934ef3cc829b5cd5b4c42c5184add8f95004c14b7e57ed706ba1c393

SHA512
b6f7d6d12ee70a6c56fb6b6255a06ac9bc88bcd2448d9fd6cc821c2d80ff114c97dae11d8a4c853b1e657aacb71864050887cd412c120ce9467c32747098b02b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8cbcc5ccb4cd248815d52679e7adae20

SHA1
1edd57921ffc2b5f27a231640a6af89640ec757a

SHA256
8d54b11272f1937dc5df30babf46b7dbdd632630315d74479178d5c139e955d0

SHA512
ba208122e036f54b3dac1fdee2b2f89dec628a0ec747ca5ea5a4593c957c67f24dd6b8384de9482dec3e4b2a9ecd003d68cf54b5f4d409e06e152c541db2412c

Download Submit