cba98ecee8d6fdf3055e29db46340ffb03b4e0330be0ecc9e5efe6a709c37b70

Resubmissions

18/10/2024, 00:21

241018-anvs5sxgnm 3

18/10/2024, 00:17

241018-alaeesvdjb 3

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

attachment-1.html
Size

1KB
MD5

2e6312617e2f232bdcc1efd902f7a83b
SHA1

359f673ba89dc5c629bf0b5419b5bdd55055f409
SHA256

bf36a349caa481417e01ce30b3066438e1d9a9fb13f4958e70b6784a6ae967a3
SHA512

b9d7e8555077a19279c8d4390b910c97923fd8ed5bcb11241c4331ea3f274ba323137077562c4ec4c03926b416cdfc573612a4fa9827868e2bbca145e60507fe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
1608	msedge.exe
1608	msedge.exe
3620	identity_helper.exe
3620	identity_helper.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1092	1608	msedge.exe	84
PID 1608 wrote to memory of 1092	1608	msedge.exe	84
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3008	1608	msedge.exe	85
PID 1608 wrote to memory of 3268	1608	msedge.exe	86
PID 1608 wrote to memory of 3268	1608	msedge.exe	86
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87
PID 1608 wrote to memory of 1464	1608	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\attachment-1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd450c46f8,0x7ffd450c4708,0x7ffd450c4718
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4171566960026524587,6748462351254503129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7d8b008cb9357371b5fafb3d8b924e91

SHA1
2687c085faedcd9f015b73b05555c3989b784131

SHA256
b08f7c633ec1abe5fe8f59ab0150f11bd8e701adaf730a80e9f4b7d6014e4d70

SHA512
703095c24911c2f3c6ac4c3f47d700cb94a4616d0d05f150942460077b30e792dedadf57d3b6202ef4ebf30540e8799265d601ea8e60d8bd9cbe4b5e673cb6c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
636B

MD5
cfee4ded10833eeb97fedb3955737907

SHA1
243dcf0011ed06d764464f6d4ecc8127cc7cd1cc

SHA256
815372ff327243afa8573e155241b919b0af10a1f4feab7123f265473e7dc44e

SHA512
50d82cee2290e622f9ace6fac009b98695de7a0643965f0e22570a297a88b1800adad94e532617a0915cdaed61fc1fb7f2b904fa597648c2b97b1ddf155a1c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f85fb05cfac2a3b7a8cc3b633d7d143

SHA1
de31d6bb5bdc6413524f438ab3596afc4a0ad36f

SHA256
d2ac339702777bba1368cc24bc3636b12213660ebb4571a924275abeb9514928

SHA512
830739bd2e2b5e0de2921a6276274a63f5c7048a22b1663aea294e02e43445ded7fccb73621067e4bd4514469fb0ce367e00794e4f3fadd6efad1714f6df70f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47fbcc4828843e60853f60a14093c56e

SHA1
c9919f2811c4941d5a9fb2fad11111f96296de12

SHA256
12da46b0e487bf5f1ef2715fe9580591af99c0445d230747154ab880d7866b15

SHA512
75bba0e4303cfe3ac0fd3867213b1582cfc0f7a6ead15cd7defba9de9727ab53e641167c0a9f1933c9eb87f061e7f551120dc88f5c4d29aca7cf401aa3545297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00f2de3d6914e613f548ee6a4f50ec2c

SHA1
4a78af75a355695a719c8b644f2ef37e608d7909

SHA256
8f1d301cd135688142f129752a0c7ccb8a1bd89f0cf58d20ffd6d8fb16e9e4e0

SHA512
ea03bfc0a60ce651192d62d7e423f75e30f6bef4aceae8409c915956e6db93eb8fa52875c4e3b9bf11e2e2bd25785c11e7137311e7a15964bc0cd29c34f6a5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
f8108720ef67a0ade15ad99d1b2c38c7

SHA1
68a6c1ed4791ad4066b374a68b8a62f51fc47951

SHA256
ec5cecd34549e03875bfe225924607ad440ecc7147629b861a4e32538fe2819c

SHA512
0a4050e7f5def0bc983dd2521507be9f3a587ce1d1de6f7189aa785fe659c42df53b835fb88db43dfa4122704d721878fcb64b09298d57e1ed7509af7f5c3ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599e3a.TMP

Filesize
371B

MD5
c8bee183c83131db29331618eb14dc44

SHA1
513e29c34949fc64f5dcb3f985e1f165135c07f5

SHA256
bf303d6a99f943c9ca7f886ec4beb453de6923a640c323cfa6a9b80a22ec1d66

SHA512
fc03372c624d4e4476fc6793dae14c26595be9a99f3f755ed4f38fcfc67873c61c0de38cd44f8396943deca21372b772e67481b2e9f2c8db18e196e2d1853940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2ca0120667aabb9a5eaa86e77fa1ad36

SHA1
00973ddaa0890bd729beab65afdc7442ecdac092

SHA256
43252d44a36c6b235d46f6be541bc2e226879666d861ad3b0e2a430b2eb0a2e6

SHA512
00bebb8abeb65268c7b46a1b59e4669adc5ec1cbdd48242bc5dc14b8d9a78468adb8cf3e72f3cb174120e0e21ad6bba4bb3d0b96e194fd200610cc479f50a47b

Download Submit