d4ef55802eab701229fb0eb7c5b35fabc08d447a33fff7b2d4b64222cb228bce

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Photo_Wall/www.delphisources.ru.url
Size

54B
MD5

62303ec0da2d2ba282bad0eca1137c80
SHA1

e0390e0ebb4c98db3b5217734f9222806f35043a
SHA256

54f2ee8e64cd51d92b931960f9395e0f4930b60658c60d8f269a36a1ed4a556f
SHA512

640b7d54c324112f3bae1bf3e2772938dd739cb2613476c51c9da6a0705e3c4fcffb9479b3cc8460197b4582ece7cb3afd815fbcbe25d5505f5de559c7dcbfb9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1705699165-553239100-4129523827-1000\{5E738C3F-6878-4D1D-A9EA-7722AF750401}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4932	msedge.exe
4932	msedge.exe
5012	msedge.exe
5012	msedge.exe
4136	identity_helper.exe
4136	identity_helper.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4932	3756	rundll32.exe	83
PID 3756 wrote to memory of 4932	3756	rundll32.exe	83
PID 4932 wrote to memory of 2016	4932	msedge.exe	86
PID 4932 wrote to memory of 2016	4932	msedge.exe	86
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 5036	4932	msedge.exe	88
PID 4932 wrote to memory of 4552	4932	msedge.exe	89
PID 4932 wrote to memory of 4552	4932	msedge.exe	89
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90
PID 4932 wrote to memory of 1376	4932	msedge.exe	90

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Photo_Wall\www.delphisources.ru.url
1⤵
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.delphisources.ru/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ec046f8,0x7ff90ec04708,0x7ff90ec04718
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4832 /prefetch:8
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4804 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1014499689486194959,2466965575339542882,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2436 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
253e1a953b9a9eb5bf8266df2d8965fe

SHA1
838f5c33198a877eafdd37794741af0b580dc95d

SHA256
5291d29b28e25d0ec2c625857447519b92f16a87d552e95d9fc65eb13b49d987

SHA512
b5ab2f57d086b736182d912c6e99d00aa9ebf4d6dce5a18312be1da99ceeef8961c654b8bf5c33ed60db4ab811b599c600cccf6bd251d254ff6213bde6ba5e27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5b8a730730d24c79e874d1f4afd78e0a

SHA1
de8fcdee28ac68098ca20146a9d4cfecca3a1267

SHA256
1e3c26e083a83664f9deac804c7665b8783a896ab50e5c60e6cd76ea1f90675e

SHA512
7cbfacd62548d5e7b24f85ff82874afd6ce26e679f2e03431f6f430da9313f600ae1f9f26c0537ba2e09da8a013cac64b1220540ad44e6381783e393e2802975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1dcac60d98023c9bb53c775dbf5f239d

SHA1
61efe5381b3786d00f84519d5292ac88bf8bba63

SHA256
d8aaac0606dbd71d509d5ed08662523916b26129aeef57f06e4ad012ce0b4767

SHA512
7477ef577f7261efba38851a1bcb26962164a1c53a7be53d9fd49a0f336fff8d8f9d76e8efc1b5f62c265de2c9165df566fbee48012f6ced835c1e2591b93124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
eb6fa16d403b0704de2ce776426ceea5

SHA1
313d1855ec1e940a401d7181cf333f3819f5a3a4

SHA256
a47acb139d1b46f9c51d29b2f6cf146942d9e266204035a780924f7320be0846

SHA512
4ede693c154720f86ff701b48397e0ff2c844a95345f6da4f0b3c0b70daffeaa54859ef93d6ae616ebc653025f1dea795ee96754f8b783ba12b98477ba67cd27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea017130d15472ac4b77cf36236792e6

SHA1
96c9e64be63ab94d41f9a9b0461f48c8a3f92df4

SHA256
7198639602e3c273951394b0854bb0ff0d142436c95c404883e352e8d0aa3211

SHA512
d332b557829b1768b0650a0e22a18e3441228b3fe0f2c969318b37931daba3891bdd13743d6afa751540e8d780e11b08da98cafbe613b9787675ce63904aab7a

Download Submit