hxxps://qrcodes[.]pro/1MlsoN

Analysis

max time kernel
246s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2023 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qrcodes.pro/1MlsoN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
4956	msedge.exe
4956	msedge.exe
1640	identity_helper.exe
1640	identity_helper.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 804	4956	msedge.exe	43
PID 4956 wrote to memory of 804	4956	msedge.exe	43
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 2160	4956	msedge.exe	89
PID 4956 wrote to memory of 3816	4956	msedge.exe	90
PID 4956 wrote to memory of 3816	4956	msedge.exe	90
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91
PID 4956 wrote to memory of 4028	4956	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qrcodes.pro/1MlsoN
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b9c46f8,0x7ffc0b9c4708,0x7ffc0b9c4718
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5297130436688196338,2537666263099571910,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
71a417a83defa82d313f42012862efbc

SHA1
bcb4cc6d44d2b2dff4cc8acc5b833438775004d9

SHA256
44b54c4d886eb5f0ba5c237a94f18285c556c9d66a3d027b04e5322bf662d760

SHA512
7e45464fecbffd0fd4c73984fe4425b38f70e46628cc1560dcbe1ba3c174a969b52556269c30094f794504bfd19cef890c21ffbdcdb163a245c27b9ac32b5202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
1784293a72b89d22c6d1ac8ab4a44fba

SHA1
be5e7d8e476f407f23a36cbcc921b55a932bb496

SHA256
547c77323aff9e42129c2ab58a54dde7bfa646693dfb67c2c99432d8a67b29d2

SHA512
39ba1f6be43d81eb45418ec8ebb4ac5f3f86eda43e037cb49c749a6e90db4e478e87b40a65144fe2701b02a5a0ec11fec2a3fd9b27a0d4427bc01b72c06db9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0f2b379b57a1f89384d0f8a4dd884923

SHA1
fd05b267d08091eb5bdc404550f45c558c414f5c

SHA256
842c6160f246a3018c4cad87ee1d54df032a687a5e9f75d3953681c8e94bfcc5

SHA512
14370e0ffd6fb5eaa3b4be4e0a9ca1d1030e98a5272af789e588f3374019902c1cf000ba3153102ccc592c24ea0e00d0190f82a14bb78075a76f4e1308aabffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c11856bbe0129885bc911cf3ae82e1f4

SHA1
8be9f81dc4f9172adce38eebf4783b404e2d3940

SHA256
b3167fa8374dc5b07b818d5f20ce37c42bccc58d30ee50e5e03b984c72ee5f41

SHA512
c13e791cfaea3bd9c9d6555922798b6e3cdc67dca8b1b3aa4278c87fe03bac9a1f704d5298f6588ef8a59db29c429766e6f0881cb8b819361b5796609ac71978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13f3dee0631abff4e801a465299dcc4a

SHA1
481baebdb917d4d5b114bce6fe05639447853c11

SHA256
b4f26d93a191c10997acd4ffec59095d8a04aa053ca542cbb9ae3038c9d2a26d

SHA512
2336043c911da3427e8d975a8da227a90a872ae59a853012e324bb67a2eec262207984cbc893afd80d40aa872495742c58799bc10a1118c1e077542cf62d9bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
895e94e57e0bc547eec0373760f816ed

SHA1
46aeb66647eabab9702ec04c2fa4e7d976b21180

SHA256
e0cf2cc824507f8e4d0fc9213ef9c1a5d5466c34d94a7b4169ea45778af01d66

SHA512
32e7b699b9962d01da94287791060409dc2c7c7f0049a5b02ccfd68c83b602b37a9104b3abe3f7b562e57444d99890368a2b09a47b877b6cc39fa033777e369b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2f95dac721235e8f3d0610ab5bdd8c5

SHA1
8f55ea086b8b58ab49a6e51943a8fe5cb423e1c2

SHA256
aa6cecc207d8ae0c0ccd3e5154e92477f62f8828ae863f2b07346aefa874da72

SHA512
1d77dd40adef67e5b0b600cdb4d0ccfd0730308d6a19945398069dd9f4892bbdcaf1f527533acf1f755f9a151a61f390a99545ea45be7fc2f5870c0d6521f595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
94a8108dfb51b021d66a74d2b4a26d77

SHA1
005b469490872d24c29afb490f39604bfdf5b98d

SHA256
4cd654def738ddd5ee00341fa9ca42c14330f9d35dc68c727b59e16bea126632

SHA512
85a7ae0a5467a68bbfb59a39ae81233a765706aa422fddbcc428f385937f8a8de2c5843f4c8a0d976e027e516a374b2e8e328fdda1e63e4aea7c1471abf83f57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5cfb25055496dfb5e80169fb43889c97

SHA1
582d41a813477dd52dbe46c11e7090af258897f0

SHA256
6de2cf368ba66719a5704a21a71472787fc4becb83ab3d9cf4c7d44b3314bd9a

SHA512
b3cbfb577d0e41e7f72472d06bff47174907a5a3b2b738837f51ae4051d9c52ec9792d632275d028513a46e921f8dbbb8c182b3b046012d2399fb8aa62dccf22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583dcf.TMP

Filesize
871B

MD5
9378175373e5cda2a8a60916d994b267

SHA1
6b0391f6e7d552e630bafb2c0570fdf59e69fd04

SHA256
aff1946d5811fbc523ef5e84512bf144205c49df0d0d8faf2d71d2bbf07e629b

SHA512
87ccfbdd715436fc480172b943149f4ef36c1663e17c356220a38a482325f81d41c4c9ec6c62438be22c9aebf39eb4333b0de22a12a9ccdce28320d8f51a4d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d7947f6222092f2609378faac9669587

SHA1
903132997c62e0c3ba0723155154018412bf3b67

SHA256
3f8ba7699a05ed78945b2d93f1e088ac5d2a85a242e8fda7d8a0e0477077753f

SHA512
9139b98ff7a729711cd9306826cbe755994b968420d96d988e12ec918384535125ed13fe755411d5374e3f936359276a1e9dc8b8a85c7a0636a6bbe4b46d8da1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit