2831f541566cf0071d983ada5951061efa67a8cbb686d8cb93527a002c521235

Resubmissions

21/11/2024, 10:10

241121-l7l6wsvrgn 3

21/11/2024, 09:58

241121-lzj2ka1hlj 4

Analysis

max time kernel
146s
max time network
139s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21/11/2024, 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

2KB
MD5

0fde74322166bbcc97cb4feb1e306f60
SHA1

673c73ca5ca0a5c2fbcec49e0ebc2f1e6d425c85
SHA256

2831f541566cf0071d983ada5951061efa67a8cbb686d8cb93527a002c521235
SHA512

efc1efd60a23c361d4a65aef2ed1ce45f36443205099f10b3618999c1f7ec3bbfcf0b6241c23c51c97b54cc5bdc7a62924aa9f93c59c94fd055fcc7737c8554e

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7b6a02b5-912f-4c8f-b80b-4ff70f8001d8.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241121100147.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3372	msedge.exe
3372	msedge.exe
3348	identity_helper.exe
3348	identity_helper.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 5056	3372	msedge.exe	82
PID 3372 wrote to memory of 5056	3372	msedge.exe	82
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3712	3372	msedge.exe	83
PID 3372 wrote to memory of 3584	3372	msedge.exe	84
PID 3372 wrote to memory of 3584	3372	msedge.exe	84
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85
PID 3372 wrote to memory of 1536	3372	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe84b646f8,0x7ffe84b64708,0x7ffe84b64718
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff79c4b5460,0x7ff79c4b5470,0x7ff79c4b5480
    3⤵
    PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9150818369548253956,13928121018967428480,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccff51f965f8f4176e4ad112c34c86a7

SHA1
eab249ca0f58ed7a8afbca30bdae123136463cd8

SHA256
3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

SHA512
8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c29339188732b78d10f11d3fb23063cb

SHA1
2db38f26fbc92417888251d9e31be37c9380136f

SHA256
0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

SHA512
77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
2de0b0c8122d4874f35ae5c65cb859fc

SHA1
71e1d71d0bb1843ec543a2bcf0a5c606b56eb1f6

SHA256
bd519fa773a5140a4f1944f01fbd2edac6ddf83e8e64fa859b233b7291310610

SHA512
ee4ef280d78db541b1d5d282d6b5eea3d59d9c11663015ca54a840e047844880e8edfed02c6ad4dcfd2f7be7988ef7269b4ca53a59fbc35dd14e393a553a0d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58dbb5.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
10ac3ac70addaa7b6e65e423d3242ef6

SHA1
d400325cf06379bbf63cd0f9418d863dd6a767b2

SHA256
c09af2183069e25c5ffb3ee5a33c47c1bee2d043c30648dee93baf3707cb557a

SHA512
f1314a7fc5420e553fdd6861d3e9d722850777c044bc012bf852a2cbfbe03e1e9a74efd75f2b2f949307910095746e5c946c20d46de6692cb8988fb1a81b74c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
496cd6e81d769045c7953a042e78ab30

SHA1
0c99cfb7ff8adf3e05ec33737511348935edad0f

SHA256
2a17e1c4944a8f73f6c01d43fa01711f61f4bd7375971468a1a7e95c94aa7366

SHA512
9b79e359720377c2e8588c33c4ce812e32e4069c686f5e93f6417e9102351f3173de7e4c169afeb0274133bbc42ce84ef21855d559192df43d569dd9e9a802fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea4de563724630cdfe084b8e786908b4

SHA1
b4a6b1efd67661121e6ff5147a0ec4d9c7039a6a

SHA256
eee8f8788a502628f2223e878b7eb66b27c0d20014e95eef30d79dd50526bcc3

SHA512
3f601fe04acbed345b57c18ca1b0a2394164846da4e5de9104f89134aaf8d90d5200555e69ae71eb80ee069aa120dd1877383e8e2c34884ba14ce2dab77037b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
86aa28ffd286b08415aa197216684874

SHA1
d99924976c73e3220108817ad6bc1d8b1795ca2d

SHA256
a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

SHA512
a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
26978f38b0bce48572b90b762b7d937c

SHA1
8b8b88012fab1d37fca79575a5db81674b424867

SHA256
b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa

SHA512
501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c01f5342480b5e41c2b4f5b6a76051e0

SHA1
7dab8089de10ffb9236c9055a3b1c2ee1d86ab23

SHA256
f825f392e22c49e40f2bae2c92ef54ef80f00362d489ede908863d3463b5bc53

SHA512
e7cf0dfdd2210f87b699e8337d04696b09a79040041e9967cd710edbad08d160a588d6b83ed2359a100530933b9391c659312ef3062c73947628b8bb6ce40349

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
2984b61464179de835d20f0487757aa4

SHA1
5e208f4138a35a6a66d0c907ef412e7b491aae7f

SHA256
e21a4c1dd6947c66c16e2d678bcb310303247ddd683ac5eeb8f4d7385c541abb

SHA512
29632bcdd2d9d6504062a47f847faa4fc392710dcbe22df488ba787eab5c3f201c2bbd5a0a5af287a02b57aeb7c0f0cccf8b4827f01b91e81e3dbb15ea456dcb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
75a003753f845fdabb650c956873e5eb

SHA1
2164111912407849b8662d1aa9dfb2f425600231

SHA256
08288cd8d4f5fab1b511e15dbe96ace2b0f2b5f12308843a4739db21e8e22338

SHA512
64ac4263f20fffc6db8c31288964887b692d3a30e5d3011c2a1db13ccb34f1be201a8f7fa84fa1be7912dc289d2e48e5f00ced802c1ae191f39f5fcb6dd956b7

Download Submit