hxxps://aladel[.]net

Analysis

max time kernel
64s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://aladel.net

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
4900	identity_helper.exe
4900	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3296	1076	msedge.exe	85
PID 1076 wrote to memory of 3296	1076	msedge.exe	85
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 224	1076	msedge.exe	86
PID 1076 wrote to memory of 4236	1076	msedge.exe	87
PID 1076 wrote to memory of 4236	1076	msedge.exe	87
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88
PID 1076 wrote to memory of 3356	1076	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aladel.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9991f46f8,0x7ff9991f4708,0x7ff9991f4718
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11532877311999005813,4904651755526673144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1956a52e00795132e286fec7b72cdb6f

SHA1
d5c006dc44319a5c3a95f7c18c91e62c87881e58

SHA256
eebc5e3a3e7faceea608faf14551bfeee89c179ce00e9d322c7e10eb9d9cb1ca

SHA512
bc86ed9793fe713c96e3c470a0e1185bdc027d9ba5da1257d215d4e65e74e7b759847870ffed992d4696dd74562efb91d3aa8f0319f1b186ef18248ae158dc69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a9b42a7cb48700b0d727d77d6ca9a3d6

SHA1
c333e3c823c9d9c064d1d3a2d3af116957f193c4

SHA256
8fc7328de97c1ab3d30fd3559c3fd565a9504eeb533aeebe857b5825e14ff73f

SHA512
1df095de080e679794df370747bf6918a750689f1eab390454bb9935f36023307da14d8f396b52950b48f2611d2e229aeaeadcee51ec105d4441922accfda2bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c161704f0a19c9349cef1adc11ac170e

SHA1
80b511f579b4fb5f4e846d045a303622f1999dba

SHA256
9cf4a22530c26e159fc541d33c9be1d933a48fc7ae2396c369e0fa0b67994646

SHA512
63583b741c98065e8e6b23e61433254d228e8e1e99423e50b40c781f560f03d8a68a55d38b159d8bb393e7cadaf24424badf1adf6aad1186bf4cfc4039d735fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0765c814344ba67ca1dc0db870163a2b

SHA1
5304b0269f3f410683593367e1e6ec459e2cbf33

SHA256
a8c83a4df9ab3587ca729973176922a9612a814ab9a5febbe328cc735258d09b

SHA512
e4dec884a7549a7ec4757a20788957b227045834b9f768074259e045fff3d42323fa543b20148390d6af525ee133e362a31556abe7735d7a1364b45dfcbfcc07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5e89d88534f98a4d6f7826d91ef6bf02

SHA1
6b577dee42e11feb05a6258e5a42693a76d0ce45

SHA256
f4b64cfdabd3b7e4bba05757f709b6cb9d70bc5f937705e3a88fcbc7c52c5c58

SHA512
49d0f68ee928bfe5f84fb1734a0acfb33f81e187da91a9d9dea5a6fd12b09042235be0f2364a09a1fc42760f76900f5ae93c98c7bc53f58d550c196d75838993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6dba6eca75bd42ad951d15ddae8989d7

SHA1
e3958a0bc5ec2da54dd72e5f90144504e447b476

SHA256
f01be52804d21350341eae8c11dab592d11469eadea9586ef11e837c20686a28

SHA512
7034c8fc776451584c8d326da7afd788c46525e8009ddbec204c550601aea5be68ed212c669a3798e9d96087dda77279eaf57b1c178a909928ca3944997cca9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
3998a94628ae196e4d2235f992887e13

SHA1
005c851ff77cc0fe65215664c6731151553a3ef3

SHA256
a50383d7c0be2497a2a1fa7cc4249c076d20773644813ca98a840c3af8ed4e6a

SHA512
82ea07a2e0b18233bd4a722ada0238c4311bfb30a07dfb6b629a02c2d431d4e9d3229926fd44765c7b221934e5ed7afddc93347183f6dcda46c5b283f0b2e029

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
72abcaba067d81e7c4750b8ac506c734

SHA1
2f815f19cfafb51bb9bd28d6f2e07502ad9638a9

SHA256
85d811cd18d390cc20a84153d1ef8d4098bc4dfdf206e04a27057e06afb60147

SHA512
2cf3a3d1d07de5aa2c7ae9a7aab10267cea8671ca7bc4ffdfa1055b981c5023eed4d15b03dcb1c95729fc1ee45db0174c3279f06fe9ee26fac2bdb53f4068774

Download Submit