hxxps://www[.]google[.]com/7fde8d49/files/uploaded/army_unit_identification_code_uic_locator[.]pdf

Analysis

max time kernel
144s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/7fde8d49/files/uploaded/army_unit_identification_code_uic_locator.pdf

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4176143399-3250363947-192774652-1000\{A4B250BF-EAEE-482E-A7D6-5DF3DE929AC5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
1220	msedge.exe
1220	msedge.exe
3296	identity_helper.exe
3296	identity_helper.exe
3440	msedge.exe
3440	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3508	1220	msedge.exe	55
PID 1220 wrote to memory of 3508	1220	msedge.exe	55
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 3364	1220	msedge.exe	83
PID 1220 wrote to memory of 4480	1220	msedge.exe	84
PID 1220 wrote to memory of 4480	1220	msedge.exe	84
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86
PID 1220 wrote to memory of 1108	1220	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/7fde8d49/files/uploaded/army_unit_identification_code_uic_locator.pdf
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee31846f8,0x7ffee3184708,0x7ffee3184718
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5936 /prefetch:6
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,12299166491522841159,13991156893400749589,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cb66da1f2fb190c08439aac192daa3e5

SHA1
d73553a80839edf93dd14c3c005bc82ed4cb258e

SHA256
79fd0d5850a21da630e330c52e5d6d7733740e57c97353ffcb394a4d0615026e

SHA512
9e959333b8d8a20806098b8f931008ab2511dee92a4ea4cda05c709875b62bf6d7e91299597dce24652c426f94c2e0ef9de99f38f1d46db5da733d41eaf156c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
392B

MD5
c163b493d0782a2e8dc186e695c6b50d

SHA1
32865f81d9840d7f1f3676b07c560254c4c7bf17

SHA256
8bd68b3cfb280e8ef8eb9d67e28e0496cb0f7eeed24bea5cb5a21cd6eb7eeb08

SHA512
6993f1f0f339354e09dbf2cc924ee3da905bc0b4c932567d1177d6a767949bf63a602d50494f4ae55b0c48478419cc095da1a4260d368b1307e078f035ab2621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
765B

MD5
5066efdf379f4fcb19a80bcb1a11fa5b

SHA1
24bda325500d7cee304df060a0924f47d7300858

SHA256
2c68385c5a2b6e3f180f25482337b875e3effaf0a185bbded0d722ecfb80cdca

SHA512
624131631fd8a5960e6f24dcabde4df58974118c36b988fb0782ebe2a43d33e30e264e11f20a8835163e8aadc6428d48f64e9981945955a832b6990ecbf7a5dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
08446c78cf67001f8155da7a45327783

SHA1
69b6138e2c559c8bceb6b6fc553e5b6bd0a7a6a6

SHA256
56e91fabd253fcff9828abee631b9113c03713a51088258c20225de75d269d14

SHA512
72a2866927f7ec3412ab913ca5c8ca303af46b5bf0cfcd7ba03987f59bbe1ac4ce2cd772a54e90c5f9e3343087637486d03d4321144c99f0bdf7018d20093464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd9b09338965a8b6b462a2433162e07e

SHA1
cd8af65e22841b5ecc59baaf2af3491b1533eca8

SHA256
5932a60d94eb0b78b62ed1a5da6ad7ba1a1a78196b43e1838d21cf61c512f31a

SHA512
86aa57ba0409ea67200c237ab32561df838c1f78b58774a4409003cc78a2e65758fe51fe97c8d32ecfa6d8e6a6b1d4289b90e1afbb918a287276e1f4c74eb00b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b62f505603a98bd626b9e9b79a51fb42

SHA1
696285be895842eb5940567327cdf519f0530be7

SHA256
2c78ea3f4f57171f12ab426b69b2a19d7458c9e3d1616f524bccb47578d81f9e

SHA512
b9a2a9bec6dc244b4dfbca908a65336480fd72de8f46de8aad6d51928b273d4ba0272c855cd3ae68c22031dd030231a39ddf8851c67921861d09759a7e8947e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcd1d15d761809b742d1313733756b6c

SHA1
1d2e9f2841ba1994bcbbef5a37f7d279832c30cf

SHA256
fecf6f019b852a0d5d6ad7925fae5deca013dc19f28a183d85527b0f1e2a1593

SHA512
7ecda6abccbd8b4b55699d1931bb74cb3d81055ea72634452bd561fa3b9f3605436c24c97b5ca67f7f9ac5126370c42cda4e49b0bc271db659d54993ed5dc8cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
657172cbd59e21a16d9546afda1a979f

SHA1
ccde15c59268e4e09e8d7ab682f715c10f4a6662

SHA256
232ce8ec9ba8d48dbe1cf2ffab7c76375a28e4e866f953640d236cbf56400daa

SHA512
b4020c2f68eafb5f0a25d556f0afd9ca93394f426d7dcf7cda34cf835efee8abace0ef8c6ce2f43ff7dfc9091b52345e47d1f53fa3db314d2b6cf12ba94bc0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7a6588158fdfab6c6e40dae7ecbba0e1

SHA1
d79dff9f89050bfa09ece93a1caf2bd5f1f0fc8e

SHA256
e021b329d9bec93ee837c7188df05534599eec94eeac21e9b57fc524bb62a345

SHA512
06cc9cffe2d4c7db2d1bf333a438f31cd30d545fe14e17c41b11f95e0a2f134a8225d7aa6898076dd11bf92932b927799113c1c02c9e319ac2cfc4371d738f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
23029c6e795f1f51b95c65c7e0c94c5a

SHA1
c27f4f1138f1c29b16a1518ac920d14ea9da2f06

SHA256
636118b62f1aa3d6fc58c7cefcc46db258630e43d360ed925d8942910cd7b895

SHA512
e2f4689376a6d081947af7ed5adcd3ebdf4922d037a72d4e7c198bb0f0a70c7590879284a516f2d04d26bedb33e7c6c3c28be05e6e8ddd703b14b1d32d45973d

Download Submit