hxxp://duckduckgo[.]com

Resubmissions

28-01-2025 02:34

250128-c2rdzstrdy 4

22-01-2025 20:43

250122-zhwwpavrcp 6

22-01-2025 20:37

250122-zd8dxsvpgp 10

Analysis

max time kernel
145s
max time network
142s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28-01-2025 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://duckduckgo.com

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0667ce07-43a1-4aff-b5fc-647e45f15787.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250128023450.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
4852	msedge.exe
4852	msedge.exe
2180	identity_helper.exe
2180	identity_helper.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2520	4852	msedge.exe	82
PID 4852 wrote to memory of 2520	4852	msedge.exe	82
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 1308	4852	msedge.exe	83
PID 4852 wrote to memory of 5004	4852	msedge.exe	84
PID 4852 wrote to memory of 5004	4852	msedge.exe	84
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85
PID 4852 wrote to memory of 4704	4852	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://duckduckgo.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffbb1e046f8,0x7ffbb1e04708,0x7ffbb1e04718
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6d2415460,0x7ff6d2415470,0x7ff6d2415480
    3⤵
    PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3248878682088543405,17238320155790916463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
254fc2a9d1a15f391d493bff79f66f08

SHA1
6165d5a9de512bb33a82d99d141a2562aa1aabfb

SHA256
2bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0

SHA512
484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5408de1548eb3231accfb9f086f2b9db

SHA1
f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a

SHA256
3052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670

SHA512
783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
87134be53aef9839c390c08eed9d6586

SHA1
d34a970ebd882c0009ddaff8c73313ac2037cefc

SHA256
9938d694f6278e0511c99aa7b80d659e6e5e5974d1c68dbe24238bd4a44663a5

SHA512
bf3b3bc29c11a79079846bd7d6872856e8a61db456a3158decb76e6ee63508f3f216849e52e1b845cbf4c5dee7743f914c46e9ac37225c6f97560d717a65830d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
2948527c8deb4e2b21f8d8b3f73c13db

SHA1
773707078efaa24da02ec43213dc08d7058b8a07

SHA256
2417d23b076f8491d79046d1624f2c9eafc9d1f14560a4290dbb5f7747b9e3be

SHA512
567907c1b9dd11a741459b59b9ba52ecb4a7aaa1468d09d1589053d4ce8bf367f99089b86e8a754e7d20270788bc45023eaa1d3ffbb17b03be4de51d6d345d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
7f958906eae68c311ec947a9438f2983

SHA1
74f28ab9cb0a1cbcc4a13f29809c415374b700ae

SHA256
483cc33ae27063a8e96381ec43f4fb0f8f731811a709ed1df528681c6034b6c2

SHA512
67c51d336710ef4f35d5b71af5114f3782dca1786e8cdffb8d767a0d0ebf2d862309935ce06c4147c680760dd421cd2cf0c67775414416ee0b31a03897072d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5869a2.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26b53f6f57daf81a840a2f9f3b2e730e

SHA1
76d491044257a12bb4ee50347c3f92a9152df830

SHA256
8e819e30a7924605af281fd678197b9f8570cf38643f5b148ed90300fdd36c4b

SHA512
ac2df2876cfead7e18dcc588b666a0befadd889312bf16166a046e648ab14a88734ca3b608872e6db663eba1bcfc6d549dc4450e12f87b08ee2d605cb0ef4bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
508c75654ff5ce63856639a404470ca6

SHA1
461b67a904fa0cc3602d0769027c3b612532fb70

SHA256
4b16b9ab1e257290d77666ee19314d47e7b3f4c8a7b57ab036b37ba814e3173f

SHA512
b88ce45dac878f15ef0021e3a75e58d530284c0da181fc49eea0de0211952f075ca2a88698fb59c6459dd559864e2951c632384e18a14b8d4eed8208314a60ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb967c611a710408afb4fcc8084c8933

SHA1
3f5525f4ef66c1536ca2de85f08804b4196ed3dc

SHA256
b866a244576c7b0337a532e4a581a405a12b64afb583a79bcc6600b2017a3da1

SHA512
c1a924b04ee53e79409975abf8a8b27c3e12c9d28e098a133209a5c7fa052f167441f02f3a4894309859312504689e132fb13cd0e827f4f6864f0fcdfd179f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc3a0ca62cfef580ff9ebbb7afc92b9b

SHA1
fde9832ce521fcd53850d0701a543ef75b772e3b

SHA256
b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464

SHA512
fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
48febe0b0625901956573dfb2378e7ed

SHA1
c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24

SHA256
f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0

SHA512
fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
8b944a7287bdec5d22e637d01bffb272

SHA1
7f9c8ec93fbc3ab8612950dd7c1a2377166ae22a

SHA256
16062eb0223aba50caa064d60c080ed45eb2d0ee1e9cf6143f2edf1474d266c2

SHA512
de8306f776462b239181486b7562c882022020db8a6ece98d6c64d7b4ccf956f3abb990085d7e3f5c3cd5e7aee60aca8dfa12ff3214c9a64ab497bf162be760e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
38530332485e0cf259570c6bf1c0de7e

SHA1
bed1519d3c348f3cf9dfbddab287cd938343c7de

SHA256
785be546ce4b6c3689c1db64713ade334f1f2273f031d295e5ec93fa5a108006

SHA512
cb0b6ebe5a8e445488ea9f23e58605bcf64833667c26d63f6076d00427b49f480044570a7b74708f5c9feb1b63f45a1c0fe1a708eafd924c8c67badbe37f5734

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
84d4b1944cbb8e1f6b0c7f34601ae794

SHA1
01adfaabf4255638057f0068483f71c98f80dfa0

SHA256
9cd79148f245c18d073ac6303986d338ba0d60538c4de835265fc539850b8482

SHA512
3a60bcf1384fe27770f4a90964c485e88bfe0092b40d130130734baa6b797ff2448a9992a865c43108d3c7383b40c8cdf32d79663eb50d62a1874d7c214ed396

Download Submit