hxxps://qualify[.]dealer-enews[.]com/T/v600000189f5b24d6fa22f87f4bbe5bf30/37ec2867059340460000021ef3a0bcc3/37ec2867-0593-4046-9d44-a3faf78c7065?__dU__=v0G4RBKTXg2GtJnsVSxJT24SEvOlOWe2os&__F__=v0fUYvjHMDjRPMSh3tviDHXIoXcPxvDgUUCCPvXMWoX_06z5lR_Ae3aW8YHIZhB_TET288q7DS3lUNZMokjV-HEStCQbx7WR5QY6l0aCXWxLcU8OyL2u1rR0zxD33zIjQ34Nfx9ZddR7P-c3q7iJFvzUUVWZIi_MJ2hqz0EglIQkaQDMUH8YK7InNF8Ui61tJVDZUD5Fy1YMZ0rE_yXZkFsjSVpt8kjDqPYK994FUMa5atjqLRkfDgVjV7__kXvJWG3KZq2kvre_VCzjIm69dfyTmm0coBtDyuXtHtv3Sw9Ck-hUcUAylJSMYqr5EyidlrhdppX3ax_6oB2FkaLbGi8SssBFASF1Tz3oESzGGYuj8-hUcUAylJSK910x89H8oDye8hkjOYQ7OODRDZMKbmE4cTyeh8FNccFYSdz9QhAcRvkf1_tw_hfk7mJ0wvtc7A

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qualify.dealer-enews.com/T/v600000189f5b24d6fa22f87f4bbe5bf30/37ec2867059340460000021ef3a0bcc3/37ec2867-0593-4046-9d44-a3faf78c7065?__dU__=v0G4RBKTXg2GtJnsVSxJT24SEvOlOWe2os&__F__=v0fUYvjHMDjRPMSh3tviDHXIoXcPxvDgUUCCPvXMWoX_06z5lR_Ae3aW8YHIZhB_TET288q7DS3lUNZMokjV-HEStCQbx7WR5QY6l0aCXWxLcU8OyL2u1rR0zxD33zIjQ34Nfx9ZddR7P-c3q7iJFvzUUVWZIi_MJ2hqz0EglIQkaQDMUH8YK7InNF8Ui61tJVDZUD5Fy1YMZ0rE_yXZkFsjSVpt8kjDqPYK994FUMa5atjqLRkfDgVjV7__kXvJWG3KZq2kvre_VCzjIm69dfyTmm0coBtDyuXtHtv3Sw9Ck-hUcUAylJSMYqr5EyidlrhdppX3ax_6oB2FkaLbGi8SssBFASF1Tz3oESzGGYuj8-hUcUAylJSK910x89H8oDye8hkjOYQ7OODRDZMKbmE4cTyeh8FNccFYSdz9QhAcRvkf1_tw_hfk7mJ0wvtc7A

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1152	msedge.exe
1152	msedge.exe
3592	identity_helper.exe
3592	identity_helper.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4640	1152	msedge.exe	45
PID 1152 wrote to memory of 4640	1152	msedge.exe	45
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 5100	1152	msedge.exe	87
PID 1152 wrote to memory of 1288	1152	msedge.exe	85
PID 1152 wrote to memory of 1288	1152	msedge.exe	85
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86
PID 1152 wrote to memory of 2592	1152	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qualify.dealer-enews.com/T/v600000189f5b24d6fa22f87f4bbe5bf30/37ec2867059340460000021ef3a0bcc3/37ec2867-0593-4046-9d44-a3faf78c7065?__dU__=v0G4RBKTXg2GtJnsVSxJT24SEvOlOWe2os&__F__=v0fUYvjHMDjRPMSh3tviDHXIoXcPxvDgUUCCPvXMWoX_06z5lR_Ae3aW8YHIZhB_TET288q7DS3lUNZMokjV-HEStCQbx7WR5QY6l0aCXWxLcU8OyL2u1rR0zxD33zIjQ34Nfx9ZddR7P-c3q7iJFvzUUVWZIi_MJ2hqz0EglIQkaQDMUH8YK7InNF8Ui61tJVDZUD5Fy1YMZ0rE_yXZkFsjSVpt8kjDqPYK994FUMa5atjqLRkfDgVjV7__kXvJWG3KZq2kvre_VCzjIm69dfyTmm0coBtDyuXtHtv3Sw9Ck-hUcUAylJSMYqr5EyidlrhdppX3ax_6oB2FkaLbGi8SssBFASF1Tz3oESzGGYuj8-hUcUAylJSK910x89H8oDye8hkjOYQ7OODRDZMKbmE4cTyeh8FNccFYSdz9QhAcRvkf1_tw_hfk7mJ0wvtc7A
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa25d546f8,0x7ffa25d54708,0x7ffa25d54718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14949562748449546533,7172498660996842253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
df7b97b564fc85a2c36b2421a67c9c11

SHA1
534786f2738340ff7ed98a4f2154eeeb2a84e1a3

SHA256
3d0fae42b27fd7d966bcea19f07b3549d39741b86f881fb6d76cd6249cd8586c

SHA512
9a97f6edd78d7350c60837ff670198acb7e9bdca6c9970721bee2de83177af8595e9377db8d6291da239ea9215233ab466bcfda2ee6133ce56a4d2bf36f97a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f8120f348264483bba5442820a42ed78

SHA1
a995bc9921d93f3d9c1000c1dee8ed90db35599d

SHA256
d3a199f8e5c0872d34b074e2c2b415c444984af3a36f3f4071057ff81352be6f

SHA512
30cd777c22f937621692311c39800481194bbac1183aaf9da95f96f817bd68a2624256e1aa8ea9edc312427800d7a90e64e8ae1d492eed70e631d9c527920b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5cbea384cc55d53c428d45c28d133c2

SHA1
f4bb7916ece2a40103294ecb0ce441e68bd043b7

SHA256
731e6e7f193214f3308366930f476159e5c91dffae88a27326a499280df9d8aa

SHA512
c223411e84df8e7c0ed0059f89d516c849c619e0755b911d7bbfe2acdbffb1736dc0aee8f5873f550d45275e55ad2bc79edbc282b8dcc09e175f20cb478499a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66e881a5e81450401b2aedb12e187a66

SHA1
935de63ea0cf52248ae6733e632433ab5fc259ce

SHA256
bb1d2f492b0723ee15bd734037e01e3b844fab8eedb4b7639837038a7cde185b

SHA512
029689b40368f60ae0a48d6c2fc9c579269c3db612cb994c3ce5184c9ead4a28f4fac2868bb6b543d6f6bbda8350a81872aedf40972683e587f43c38a659d64a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
026ab8896324b4faf1ef7e6842ce8234

SHA1
810808459fa59c9cae93de1d8ac7a9333f578fac

SHA256
f61bad703085f3d62de3c547a10e15c1495af9bae9b4b4853cc6af700ec9bd78

SHA512
50ee8afcc5fec9145ae2dd5e2033e613a824f2b5d6554668509298848bdc7c0657f888f465eca70bfc18fd01fab65362bc172766702222f10c4bca36c2ea293a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c1bb9de68cf5cc35f124c26c00e306b4

SHA1
c4ebb6c5c09e08adf40dbb29365984a84db1fabf

SHA256
4ad030a824afe99eae3d25c9356d3ec657976a6539b56768bc075b633558eb2a

SHA512
a4cc1f2930272448d6bc4a8fc68435ebecc39bb25468c9245f16919e82922573772bf6e67db8b85f7eea12456226ee6c746189b6f4f5bea4a4de925238074d1b

Download Submit