hxxp://www[.]maliciouswebsitetest[.]com

Resubmissions

21/08/2024, 09:33

240821-ljd6da1cpg 3

21/08/2024, 09:32

240821-lh26ta1cnb 3

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.maliciouswebsitetest.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
4392	msedge.exe
4392	msedge.exe
2184	identity_helper.exe
2184	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2360	4392	msedge.exe	84
PID 4392 wrote to memory of 2360	4392	msedge.exe	84
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2592	4392	msedge.exe	85
PID 4392 wrote to memory of 2688	4392	msedge.exe	86
PID 4392 wrote to memory of 2688	4392	msedge.exe	86
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87
PID 4392 wrote to memory of 3300	4392	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.maliciouswebsitetest.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0d9e46f8,0x7fff0d9e4708,0x7fff0d9e4718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,11422649207707854880,5857603241727677427,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
16KB

MD5
8c092f3c795601befa6b228d0b1e9767

SHA1
a3cca86eed1e9c9c242ba11a36f518f0c580350d

SHA256
0ba3202e818f04dc565d8b8fc54e8edba081faa6b36df397633eb3d0cbbc89d4

SHA512
53f953daf7dceb6f6a4b275d1de82f40589114536209c3334d3ae26079a216572ceda505fad4e025548b9beda4ca596a8c96c9f9a41a820f7567012cb6921afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
de0fac9e8a0b4076cec55b56e46af399

SHA1
c2ae531fd9e04bf608d9f68bbe3010bc3bddb579

SHA256
197a56abc27b42a7f45c8a4aa33ebf0d57457430a2fd03cf1837827c8c3f6ca4

SHA512
0a0d6cd04af75446f6e1cf0ddffefe19d5cb8d8a686f3d461d0c5d05017c74c1ee02fa9363b2ef646cff68bace94a96e8c0e5d3c42510b35b438660db789ad39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
479586c7fd8c3b4002bc72ec6afc25ef

SHA1
e00bfc3931af1811cb56da4c2607836aa6a0b932

SHA256
736e484594ef1be492a7e3e5952bf30ac39fa574102328e939f2d395728440f8

SHA512
2ed0017a4d9e26df2b927a6e8000c0aa5c569015dbbec2fbb5a6ac8cdccb2ece6b788e04fa7000a8e356d88a5c6ada297161eac0c71e3f8c6f27b067a1afd599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d1e6235d065865dae0df959c98a7ab76

SHA1
c367f80571ea585f997e880f00994e61b3a1517e

SHA256
5117dcf58b3ec881a777dc39fcdf885fb6506ac80c046a8520295a17d2e1dcea

SHA512
6f669feaf89b49732cbaeed6cbf94a58f1ae66c6d539fd3e5ccb584431ac2a0e7ecd69f40cbc0baa73e0e7601a8a54fbc63c73fb7948b60bd67dafa5df9375b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a4f73aecfc32624d67a8cfd6874ec82e

SHA1
a880fba913f996620bb10786c21dc3c244fd79c8

SHA256
5031e05b34a6a815119b4e43e0fde857e9bc3f73f7c6408e2e0dce41ec2dad83

SHA512
ac31e5008cdb1eb02538565b47012087381f8c24308d4769ebf4452fc9e872648797e31cd6022a72664ceae67ea28ea9cf161c09504a68f16511eebd54c291d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
678a9dd11b70290ef8527b30e9556ca9

SHA1
a5f12dcb8224681047bd7b365d1d839eec46cc3c

SHA256
045fac213f6834c3b99c3dfb536ae25a39539c29a7221e884d1c364d3a5356ff

SHA512
f02118176063a07a00c3042bf4cfe0b38d8767ac3908cca4a471b15a0212513383ca1ad2b38ffb7d04feb0704ff3539cd6a6b126e8dacb6412367791f2b70b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b9babc7c50ae46358cea92b7f25f9ec

SHA1
868a60f5fd28355f333e1a9213b9661e6511b642

SHA256
575c10dc4b25ce76be8e82ac3ec78a2ace49d494a64e310cfc715abf4c1a6675

SHA512
2e740debaa7108c8b6353629f45fe47bb23fcfbaa1496e701d5b0df9a1dc9b635bd7d55595374b3855a8404d398756d58e09d4b8d378a35648c14d780992c963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ae287230757b7bc443cf1d0a36be554e

SHA1
140931e1cbdc4ee23808f2451f13cb938dee505d

SHA256
d7e4dc8ad9dcc168dccaa23ca5e65e51fab9d9c3c172da32ee95f0fe7f4fa599

SHA512
d7290a4a54ec99952bf7dfcbd234aadd69384a584bc032bc8468f324ebfae7d374a019411a7759c37662096938af7fd91cfc9eb5593711459ade52514b64596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
1461d2f51e3a88a360874af167e63e37

SHA1
4452cf96890521f217c71810f2ce4114a97d0979

SHA256
c1671bf80ded6a80ecf7bf2eff330732c4a0f08e11997607771719560b657a7c

SHA512
af35895fe99928ad86cc8a8e56735f578aa01195ac446c899face71905d199d60cfe94e2d1883bf68c0b290e03f1202a49cb223d60f7a042ff478ea723cf809c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583738.TMP

Filesize
535B

MD5
526607209ffdc05cc811e3b3ccddc2d1

SHA1
bfd8bf73c0bedb6922897844da683aed7ac49d73

SHA256
11afadfef2ab860abcfeaa05ce52843a7fc849ee5ea5e52cfe497d89137c6030

SHA512
5512641a936ccc707d448a4733f843f1a203945f15bd6e72d092a5de9f7dcef8bf23a6fc735943bd0a1fc77b82f3632993748a060ecabee53914918a6cca1552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
419761415ecdaa61900bac731b0d4a10

SHA1
7c2cd03b21c279bc52ab2d923c2754b38f63c426

SHA256
c5caba996355faa46d2ea4e08d162bb85a8f3bc7eac826a33314a4ebdd39c086

SHA512
f867a62291522c8eeda0e3313cf6d001c08caa67cccd430af0fb4b66531ff9bd78384254b318cccab2ca3b0be47a654d0d84395100fd1a148fb1a6c7c74c7df5

Download Submit