125153d204d870e75885699bc133a3eaaa7cd1139c09ed4d7fedf04d3610964e

Analysis

max time kernel
49s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

503KB
MD5

3de02cc71c0861fb522271006b0b23ee
SHA1

613fc6b619aea6443902bbda6071080cfcfbe558
SHA256

125153d204d870e75885699bc133a3eaaa7cd1139c09ed4d7fedf04d3610964e
SHA512

8fc5fe6f5be15383068d950a6a15ad2fecfdab4b24bb4339eca6b4c7d75551bf3321a35dbf2e8bb5ba0565ae33ed4c7022a8b169a55cb2197dbdd9d01a91776d
SSDEEP

6144:gA6DksDkSDkRDkYDkLDkLDkDDk+DkgDk8Pt:gBDZDRD+DhD4D8DaD3DrD/Pt

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
96	camo.githubusercontent.com
97	camo.githubusercontent.com
98	raw.githubusercontent.com
92	camo.githubusercontent.com
93	camo.githubusercontent.com
94	camo.githubusercontent.com
95	camo.githubusercontent.com

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	63	https://fixupx.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8b7a2ac689f692e6	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
592	msedge.exe
592	msedge.exe
2836	identity_helper.exe
2836	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe
592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 2312	592	msedge.exe	84
PID 592 wrote to memory of 2312	592	msedge.exe	84
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 4588	592	msedge.exe	85
PID 592 wrote to memory of 1516	592	msedge.exe	86
PID 592 wrote to memory of 1516	592	msedge.exe	86
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87
PID 592 wrote to memory of 3420	592	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a90f46f8,0x7ff9a90f4708,0x7ff9a90f4718
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13779824028679841296,14883497955336730420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8647915cb99384299fd4c6c0ce1d5b94

SHA1
7b15a833e347b2134bd891f96eb6ff655c7fce66

SHA256
ad2a7a94a7be97ca50d99a49c48a9189c477fe88fb0e4b93c19f6d5af6eb81bc

SHA512
48bc478040777488ebee3f59901e8855e8b86e9f0af14236560d45b2565f7b9dffe3eda52ea4dcc4aaac058327adabf414b120fa0728b0b30cad9e454adcb25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
999228e638194cf636cc904e883d1cb1

SHA1
732f3a1ba9a0837d9b7a06950e023058983c7212

SHA256
3374d72a48400501b7a60523def9829a4af1eaab3ce6b8537747da3b3a6e2d21

SHA512
2d55fcedb67753e30f1ecd31782077e9033c5839fe182085239fdd2226be21b441f36f12c131a061708e7e30b80069fee94a73d7dc93f397984ee293671af2cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74a7321db5a5ebe811013ce748a4c9df

SHA1
d316fc0a1de05eba442e6a613e1fa06174d94932

SHA256
87bd1554c65e8d65d718b0fc5faf6d97bf7d0af274b6b8ed453dde33eeb904fa

SHA512
1b65088c81cdcb14c5fce8aff6999fc2a1d3d2dfed4268a299399667adb9ee0d00a219772de2021f0dfa38b8735f7d62a0ad0188668ce11527c2b3d587697e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a43d4b781349ba9ea3fa6422395328e

SHA1
e31217077b3840ec4f780d4fefbbbdec7ac01981

SHA256
d3de14f4b316337511c58a3f5a0aa55259613ef2b0615f9364cdb761589f1f31

SHA512
38f416e4520b35d9d4c5804bedad47f2433f8cfded478f81c50ce3f35f3b61da3f46bd78200ed98faea0f5f8c9874aa859f2204625f99b5d67256d7d757fb918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef72e50d9bd91de5c5f4cf3124e1e412

SHA1
816aac73633924236e03a1e514ed79d9bf91af01

SHA256
9f86b59cc6afa034ce9714b36644c661d1e8311a773a367c7052bef7842d9fcb

SHA512
7e0a4aa561000d7ddaaf93d3458ff610dbd2d2ab0bef9c4e7a6e025f9e3b3287d105e58caad452c565b0f5c0fc0e0a158a12765db1bbe8c6425f4c115eda6950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6d81e0f8a829c588a87f3d0c9ec3a300

SHA1
44b5bd93fb9842d72d0add402c4dee07f698be13

SHA256
3ca47402261bacb8f8aac709462f479c91938766fab771015bef43bfc2a73270

SHA512
f51aa5dc814b0b67841add616d2fb37c20b00de2a11c4fe9d449886c07e0cb8ea935b3f54d258d0059ded45f3c30b269acbc1272c090a79034b485a0a29c1ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f64f850098be095b8e1d507978919fcb

SHA1
c4854957777020e8582794d7f0775b450c72edfe

SHA256
0e012902271b4e94416f8c8161a0f0a2accd3d7092db6b1dadafc529677eb6ef

SHA512
d33141610f4103c5690506d691cb2e6fbf56174117f5ed6ac01be9c21e1aefff5e060ec4ce039431b4726b0aeabd91618bcfdc0e4343a86a1b084022acd26b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
29902eb2370347e4533dbde9b354c5b5

SHA1
0cff7e55ca808e3f374dbdca63c15b8b00e7d7bd

SHA256
68dfc18e4fdb95638ea41d4346c13430cb03d73bab7540134822cce1dfaf0823

SHA512
91939901ed2b92cf537b5d4bb4f44b5b4fb1a0d38b0bad6e11cca2a0c6e41f3eb8d221433710013d84711e67441882c3d143515a99124076154417225e2c2ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583ddf.TMP

Filesize
1KB

MD5
c319f3caafd36d74825c1610ab1a1125

SHA1
ee229449df8f876a78ab87501499165d414f280e

SHA256
380535b855fdbcd1ef62d9f8cda2e6c92efe9ced475dcb7b0a83460b5b47b971

SHA512
bad51de9907c231d46dbca37b6bf2b923353711640c3dfb68df7141bf15e67ac9d86ba8ee0da0976374364d012a3e00373cead29eace6d6c6c47450952149a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
913ef6a0e1ee79e60099ab3d5d82a4a0

SHA1
ad0bf3fdee2aa91ff8a421e1aa6b59c0db1beb59

SHA256
8223488bd64117cf7423e0e2378350b1eb10c8a0b1e80067cf38596561b031c0

SHA512
837d1ece30a0e57a7f95e93cedb1e3605f9c3f2c5d9aaa726d1f8647b8fafe1781a9d377934cc26eb380ad3e2b61531a173aa4d814b482a3ea216d3155cba365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f68ad8b3f2e4a0404a1640968c4894f9

SHA1
01623c0b8658d76949e99121578bba00446423e0

SHA256
995bb2b29928bf84be38e8faa603a3b661e9445d478a54c5ecd898ff552b759b

SHA512
14c2dfc450abd04b8bbe69208c2043c8620097ef5250242c71f50c0255b55cfd28d217f1b980b6b89b41e522bd47e5fa6f3e5fe04e054536f1faf0ae0cca00ac

Download Submit