ddcbe331e610f3a5cd579662826404aeff1f9ca5be2db4ca3e4e0fd923cc4b48

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

idm注册机激活/安装及使用教程.html
Size

166B
MD5

2d057ea83a1857ee629ad4b2718dc9a6
SHA1

ff60e7b57c0d374cb3ce01a97b36db3a7c41f85b
SHA256

016419f8453f79f96f041762456b075f813a061987819a3b3614aeb0ead71731
SHA512

7c4859ce86afd3645fc561c5e1228249e06ad37632e676e6b56cffd76ecca94f0b207c9db0b2edabff46d2d94c44f8ac2bbebf23f31d30c51276c5ebfc3652d4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3764	msedge.exe
3764	msedge.exe
2100	msedge.exe
2100	msedge.exe
1412	identity_helper.exe
1412	identity_helper.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 4432	2100	msedge.exe	83
PID 2100 wrote to memory of 4432	2100	msedge.exe	83
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 1160	2100	msedge.exe	84
PID 2100 wrote to memory of 3764	2100	msedge.exe	85
PID 2100 wrote to memory of 3764	2100	msedge.exe	85
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86
PID 2100 wrote to memory of 4004	2100	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\idm注册机激活\安装及使用教程.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a5946f8,0x7ffa3a594708,0x7ffa3a594718
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,9976664433940338893,8098701363829733108,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
e61e2ffca2bc8c4d8937bffb41c955f0

SHA1
940b896da5dab1fb3d7e38d43c34cdfb61389f4a

SHA256
95ef4966b332f55f4a9e634601146f3ca499039576e81025efd2dbb44d7fd470

SHA512
75593778762228f40dd83433099955459a93b7c93dcf650853749d06bc6a6c27eec748acf7942bb8bcbf1be49f59339f8d33a61ece2541f264a11c763f975ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mi3lgoh8b3b.feishu.cn_0.indexeddb.blob\2\00\3

Filesize
210KB

MD5
5febcb37b5bcb918b5dcbf842c2990bb

SHA1
b60841bdc492167bdd467a3d3e4ec88e2c141b0b

SHA256
5d93b97c608a62c99941c3b5022c9f1bfb968a13eba8ae0c4848b43c77cee718

SHA512
bed7210459fc37edd485b544a060e8644b7efba5560d40bd6ec044c45a4d1d987a7584ebb98a463123f232323ce19c6f6c74553c792e8bb2b1999c0f4a2647a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cf3c84b5d739a359a67aeeb7649caa69

SHA1
0796046cee705c33b99565d66dd753f21ea96869

SHA256
c179deb83b95f00a68616cc9ade62482b7bcef7b9d5361f5f4457c4ee3b3c792

SHA512
36d458a97e9db3153388bfc4756c9ef418141ddb7260984685f3167abbbc400d4b74337f2b424e01e22202d2d5f2ca4a913a6f5e9dd76c1fd3f62e82d7d4542a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ea16b02806284b3cdf7d454ca6754d6

SHA1
08ba29c057dde921b587cdb53f0482c35d0c2b7f

SHA256
5f3f04a5cc5af99f58914152d8d982a95aa6f3e69fc41fc2187c23a096634be3

SHA512
dd8bc105a2300b30679da44ea9ce75ef9ad4b3735606fba28263c35a989be97319565f5c2b93a962873668cb203f2fdfad2ddf4db613d6587382c2d5f7c582ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abba159bedb3807f49da47d7329730d8

SHA1
f2cef0504520bf0ece489a6b2adb75b98542f17c

SHA256
dbbf671b232a85be7e422fd0a0f315cb663edf1f7ab7763ae527efbe59dbcead

SHA512
a285076ad22d65a265d4b573a8bab3f1c9f24ed58edf605e27f0315cb75164a6bac36076952b3b93bc28b29e87bc057c44f99da7c829b9f385524d187a10d3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c631b80d735146ddc6654e224e427bf2

SHA1
4a7ee01cc26a299ad3ba53056e441f1359a1b577

SHA256
97e95c74845385faaa80500c6fad3089524fdd35189899d919297e5bb20b3040

SHA512
be372d3df2772ad4fb140f587e955e0d74329e4af21aad8170c643de2dab216c16f3145740c6de260db6729d5656c9d80c297a87ccdbf001362cbfca1e0cb124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e0cabfa842d7f83b34e14b06480c42ea

SHA1
d0ede8144ba6a928550b11e9dd95aa10dc1df7f5

SHA256
25c64600f97a077ba20d4bd6dd13d5ff538c7bc9f36afaf76d57aab35f4765f0

SHA512
74492fbe067744998bf16c9ee6430344aa77f79892953fb7fe7ca4c982a938b5eca549fc03ccb7d7434326ed280e54a8925315757048b6c1f535addc279eef0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b76c6ee1f3aaf700d014dc2918313315

SHA1
b3c62b995687eb64fe3b84ddaa0652d365c53563

SHA256
75a90d3aac50c6f8e25d4fdc0d9de286a5c8c034476d997b837eb77f7cdb1708

SHA512
7c50f64f6aedeecf6961ce6b953525d11008389adda0f97efea7a4fa0084445536f7d78f4bf4ffc4ca5235a6bd980aa3e388dff1798f8647c2aa9d3b2b48c60f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5823b0.TMP

Filesize
48B

MD5
ef92a82905e44398af47554b63c04c07

SHA1
2285c7c52cd8a69d979b8f098d788faaebd890d8

SHA256
f1c43cac2eb1684e28da8b36bc8d99a489704eaa598631c454fac1ed25840efb

SHA512
fbcc74145c17f9136d2c25708b0716bb0c6b75ec9add5fc1071e04db8429114e8158bf13187279f854d37320380a33e36e3032ddeeeac78eda516ffb440d4287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c8e5efdc8c233286447f906aed9cfafc

SHA1
5d76256fb1d1f0c587c7edafc689a09be7c23bf9

SHA256
3eb20bbbafdbdb51350ba55d77c41c763e434a5789e66b3b6f1fed36658bcd8c

SHA512
597343deec64f923cb67ca5e2b27d57ad6b4781ba1cef47b543c08e19c8f3e8aa894bd50d705ab56f9d20fc53fd09953348f494432a607505b66693ef4e533ed

Download Submit