hxxp://hgcaspri[.]comhttps[//]r20[.]rs6[.]net/tn[.]jsp?f=001tMV83DoeSkx4reI7zgh6x7ExPunFU-GafNTx44bm5ey14qrn3E-4MMz9vaCegjfskZniUQulnmlyHHlSRAc4xRc1e1OdCD2KuPQJ4tXPSjL1tl9hS24tuOw9EY4qFF8OxVCNuGT6thphanVsnX_9K8JlbLC3sEyCaZ_nHhHqWsvEBe02GogGYg==&c=&ch#manish[.]sahi@volvo[.]com

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://hgcaspri.comhttps//r20.rs6.net/tn.jsp?f=001tMV83DoeSkx4reI7zgh6x7ExPunFU-GafNTx44bm5ey14qrn3E-4MMz9vaCegjfskZniUQulnmlyHHlSRAc4xRc1e1OdCD2KuPQJ4tXPSjL1tl9hS24tuOw9EY4qFF8OxVCNuGT6thphanVsnX_9K8JlbLC3sEyCaZ_nHhHqWsvEBe02GogGYg==&c=&ch#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
3088	msedge.exe
3088	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2684	3088	msedge.exe	47
PID 3088 wrote to memory of 2684	3088	msedge.exe	47
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 4784	3088	msedge.exe	89
PID 3088 wrote to memory of 1116	3088	msedge.exe	88
PID 3088 wrote to memory of 1116	3088	msedge.exe	88
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87
PID 3088 wrote to memory of 4624	3088	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hgcaspri.comhttps//r20.rs6.net/tn.jsp?f=001tMV83DoeSkx4reI7zgh6x7ExPunFU-GafNTx44bm5ey14qrn3E-4MMz9vaCegjfskZniUQulnmlyHHlSRAc4xRc1e1OdCD2KuPQJ4tXPSjL1tl9hS24tuOw9EY4qFF8OxVCNuGT6thphanVsnX_9K8JlbLC3sEyCaZ_nHhHqWsvEBe02GogGYg==&c=&ch#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb173846f8,0x7ffb17384708,0x7ffb17384718
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14592230085082027585,16070479840570599584,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93b3c685ea3a2bc386ed8ac93220a96e

SHA1
c90d075c1e4e7046a578bef4e30d26177b6785c9

SHA256
0cbdcf7f375624a0bbdf5a5fcced08aa54351fe17633a2f2905904135209e394

SHA512
5f417fc1b4497503f6f9cd35550acdd697b44c29e9e4211d86fcbec5598831623452789d6d326377b673257ffcfa3da9810e0b70011d39ea85886655f017fe97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f645e840a26ad39c98e1320344bba841

SHA1
e373876607ec3ab63956225db0218d052664db70

SHA256
1c0ae4f0ccd79fda55b9f62df6dcf5cb4e042dd4d03694b4b150d3dcfbe82f4d

SHA512
a3f4210cb9ee3e46ec1e022940b19d8462e64f400099212381ebbf93cf300dd9ec35f9f866ca9909f4c5df7d9182f1aaf36aefa3b26dce38a86662e877f6ede7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8aff0a643dfd036198c726a98ab01073

SHA1
ad7d02c484eb8ad67ba0aa9e370969482100878b

SHA256
76c8757a621cbacfc265aa3df75ec36fe543ef301e2c97b4c088ab20065da734

SHA512
1baf87902534cc25e384ba82112c2bff0cbe43b7f36994075bc62e8afda063b8e3b5874e3441e52c2134ccfbf123b55bcf7c54f135fd78a32d64396c15e4f5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2014c00e7a97c00a1c234e85ee690930

SHA1
024529d738a30f53a16555b153eb58316ec34e45

SHA256
a76d31a9960100fc56919e1098c81c25cb0235cf97a95bf62f0068f90e6575e4

SHA512
c1c69547bae429f1c079d959c77a10af7b313147ea2c1117084d3bef7ee53ae9a00abea24861873c68f0947bfbe4873638206ecbe8a4a877c4a234c6e96116c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa85d62c4e2e62ff90034d133436e021

SHA1
331ffae5636a1e03c9c2d85e31afa1a9c8a8d2b9

SHA256
2711043dba2a99b8c61c4db40d315b2012e80f079d521c5334c23f97592167b3

SHA512
13e46f40acceacc62dcb7656d5c00b4579358135343a3f0fa72e154fb349fb58641c24cb476575b653a85e9cb616affe8036365296564554a0e28143bc253509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d299c046e2530060b38a5912eb6c2ec2

SHA1
38820f83e7ad6258910528328981e1e5deb88f6e

SHA256
8f2bb02874fc0c57060dcac7051e59d2ad521e276f0e53cf5eb636c9be4ce3c8

SHA512
0a9fb374dee5e0a8326f9ddd97d280af0c1ce54f528dcf8813f3b2e90dad49deda2c19e598360f24677928c1152e8ae6fc519400fefc8ec0bbeadbb5b4915ab1

Download Submit