hxxp://shorturl[.]at/9zYJy

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://shorturl.at/9zYJy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{7E8D96EF-42B6-4A6F-9D97-3A843387D7AE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
4084	msedge.exe
4084	msedge.exe
4412	identity_helper.exe
4412	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4760	4084	msedge.exe	84
PID 4084 wrote to memory of 4760	4084	msedge.exe	84
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 2620	4084	msedge.exe	85
PID 4084 wrote to memory of 3008	4084	msedge.exe	86
PID 4084 wrote to memory of 3008	4084	msedge.exe	86
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87
PID 4084 wrote to memory of 4552	4084	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://shorturl.at/9zYJy
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbc5046f8,0x7fffbc504708,0x7fffbc504718
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2130506230524915385,8622786810002688553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19006195-dae4-4447-b8f9-e3c49ab92797.tmp

Filesize
5KB

MD5
9119624af09c75070259037e4f7a4633

SHA1
89ddb830455701d81ee8736ebc04b36f5c5707a2

SHA256
c98cc50456c4b55787647623ad626e73fc4a3e806e387c294b6e28d767d75bb8

SHA512
e2c9dcb81176fc4704b5dbb8ff1a9f5b6d75ecacbf09f9770f93280fdce751cc7459b1385fc3ef41ba4a7bc3346c1557a1313da16adec17c7ca7f5c3f900177e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a63e2a7ade6d56a3e6d6f9af04cb5d56

SHA1
6d814c59c29666c15a4766afdbe27b4fe2743f64

SHA256
ecc2802e1fdce9cf0ab506a6228f033ad471e34c003c8c8ab8a201df96f5482f

SHA512
3c7e1152f4263e9e8e124417686e05bbf4f8cd74fe1bfdbf3ad4017ee8a47a11b33275e516220aa41b5e6e81aefdf1f5484518c2799378329c9b0fb888bc3736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
985B

MD5
266b301420e2e8808fbfc491c318f23c

SHA1
f44d031f206f013eb35ff2a2c7d578f6e4006ed4

SHA256
3c3114877d41f5c683d878b0ddb7d80726848f3a5c85a96c2f2d803afc735d49

SHA512
451fd97d71cd38687dff80732c93925a6e53f61c98cd867242ce0e1c72b1f6a570d999898d59628fda9987ec3fe980c2e3cc61ba5a18b051dfc9878af5a4a95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97396f1e664f4861fcc232ef786e7628

SHA1
09f28d3103b1b892b6a4c5fb8fbbeb5668ce478a

SHA256
9d08e6921fb84d95ce92bb54d7f47f0c0537989e7cdc81a5acb638e95f3b46a2

SHA512
d17844f5c5064d957a88d4d7edb965550baf59dd8e40b6eca19fdefc089f5723e18e410550690f23c5a1574accf5d5a5372f6fe4a465373916bd428a45fd502f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c42a04f7a8223b5f9562d3c672eaa13f

SHA1
aa06c4ddc0f8360518fa1f93cbfe202aba6f7387

SHA256
3ef904a59e809d23d3a69798a6fcb52e92a50b352839d3192d87ac6ebd0b544b

SHA512
3e0e351b17c3b924d40486192b7ce725ad8de3bd39e8dd640afa1cdbce7029a6c67778349935201e441ec00d69d5132d2b256232e7de7966e9b6e4702c58724e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
372e8a6a7d8405ef0a101b1d7adf8771

SHA1
34cdac6e558434fbe11a08515fd7110921b5ada8

SHA256
28775401c5d4176d5e8132bec769f26af83465342436153682357d85506ac231

SHA512
76ceac9eec6b3788134f03a8d7597632b6d825582241885c34de4c4ac4e10c56c905ba28a92b1ed42d2dc8ad7333360fe6957723b0b1ceabe282108d6fa0bdab

Download Submit