hxxps://myqrcode[.]mobi/6501d11b

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2023 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://myqrcode.mobi/6501d11b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
1400	msedge.exe
1400	msedge.exe
3196	identity_helper.exe
3196	identity_helper.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4732	4340	msedge.exe	82
PID 4340 wrote to memory of 4732	4340	msedge.exe	82
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 384	4340	msedge.exe	83
PID 4340 wrote to memory of 1400	4340	msedge.exe	85
PID 4340 wrote to memory of 1400	4340	msedge.exe	85
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84
PID 4340 wrote to memory of 2480	4340	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://myqrcode.mobi/6501d11b
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbeb1d46f8,0x7ffbeb1d4708,0x7ffbeb1d4718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,3817620476561549542,5273244094751411094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
02c3647984039b3178062370f202dba8

SHA1
9bed441b9c28d03e4e9eb2d03bc00bb93a3ffb87

SHA256
56e5efa85a2dbed9dc1c1b8ba86dce6284cee5fb06b629306b51ba042210878c

SHA512
eceafaab0d091e3f4a6e57d3c1b2b03287ace5c47357944db3a2bd582c472755a0c5006051cb0522c3269cb5f32dc094413ac6fb6541c088929d3fbe6ce00363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7d7b1e38af3157e70c2cc2f066c6eb52

SHA1
3e5a89865a5493b0e5acbd4e6b1a48b8b12304c1

SHA256
383d374bea4e770e0bd29e006d5ddf62201bcd578ff142f11ed611642b1bd9a3

SHA512
c463a3c009cbd541ab2cf6dcbc705772bf6cfb9ae40ebfb3acf2ebd5f90ef4642e2849dba158e381975c4fc3d08e6eb482b33e413e772e4015e565944b6cdcf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63f18d6724f4729a899da5e905938507

SHA1
c24fad4cf3a49fbf624f06cf2c15fdcd18838933

SHA256
3de721c3bfe78d199309957ec26d779c77ccd553204bdef2ec2e80e4772f8769

SHA512
5998c869bd2dc7d2763d7d46fbce818e9b0833bdfc497e7becee3db38662febc9382e0eda57eaf998a10bb7844f718f69d86d7d9436be072b60927c796034c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
33c8975b76cebf1a54f97bb6d96e46a4

SHA1
7494e39e41e0d5721084215861de8093ba05d559

SHA256
8aeea6bc2df0b63c50906a9d162cacc64dbaf4bd4fa728e2e7240637f44ee122

SHA512
2d5bc5cc7b6e6593d1557753c8063388d59a96990a4a7281f2e081955430d57c622bd7d83872677ea06bebda072fe66b379ec7b0f8d32e1d3c14da12836d34f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
75a0f7ee3f447c6eef49eab82f57a051

SHA1
75a945cbf001aa7f270595342c5b6cd901d37c37

SHA256
bb0b535484fd5ad06cc41427fb6fbc21baec74296328584910e286de4c928b32

SHA512
a3a598f2f97cd514ab548b456cb6efc078edbfe20576a5aa0b86c0b5ee41a564355f4e36a59d476a59da8d0fb58493850fb0051674ca4cd32249b5d9fdb95e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57ab04d20fe4dcd668f18a1d244ad154

SHA1
3addbd889fbcc776036a24bfca36294db237869e

SHA256
062b638c70c2f951d68ce91a35bd5b20c45209e7a5a778b6d3a6c1bd88258d62

SHA512
a2ecc2174a4b8e4605aafb414fef7730dc27c1e6c72e86ddb4a641bf16583d3dc6a25a0468f7f9653d2d1c5e068b34db67ff937d3dd25277b75f91c7ba525f74

Download Submit