hxxp://url3668[.]elinkfinance[.]com[.]au/ls/click?upn=XhIMYaiKxyLRuOFMetKQp34yODrYYMOv-2B-2BFs-2FphN7naDFqFsZv9dPWbh7Kk-2FpvbQadh-2FY8oPhC-2BVFCGIPL2zeF0jYhNF44I8EOykKO1WagO2IMA41Pf3oxKBX2eRfiOsJgLiNqpwMj9PNd95x4lYLaJvYJdPmdlO93GyaamVni19TWSafj2FTIYfU0ZW9YEhYoB3_fuXO7wlL-2FczQyorfHOsKx3TtPInqkde1j5Bci3LpLzhI1hDsw-2Bwsc02qAXRsyV8VHyLSrFn7NQOp0nAOXz7Ha8xFjRB4jUjbvn6DEB0QnzLuebZdzQhpV5NEwYYqS1pIUoohraNB2NESAX94eWjDd1-2F14Yg2i3eb9s5dhGpbrogqx9C4stMK8reDeD6hSWh8ILD9EI6Sj-2BMMgFOggDoizZB7UcfiC4dOubox6USPK8E-3D

Analysis

max time kernel
80s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://url3668.elinkfinance.com.au/ls/click?upn=XhIMYaiKxyLRuOFMetKQp34yODrYYMOv-2B-2BFs-2FphN7naDFqFsZv9dPWbh7Kk-2FpvbQadh-2FY8oPhC-2BVFCGIPL2zeF0jYhNF44I8EOykKO1WagO2IMA41Pf3oxKBX2eRfiOsJgLiNqpwMj9PNd95x4lYLaJvYJdPmdlO93GyaamVni19TWSafj2FTIYfU0ZW9YEhYoB3_fuXO7wlL-2FczQyorfHOsKx3TtPInqkde1j5Bci3LpLzhI1hDsw-2Bwsc02qAXRsyV8VHyLSrFn7NQOp0nAOXz7Ha8xFjRB4jUjbvn6DEB0QnzLuebZdzQhpV5NEwYYqS1pIUoohraNB2NESAX94eWjDd1-2F14Yg2i3eb9s5dhGpbrogqx9C4stMK8reDeD6hSWh8ILD9EI6Sj-2BMMgFOggDoizZB7UcfiC4dOubox6USPK8E-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4432	msedge.exe
4432	msedge.exe
1732	identity_helper.exe
1732	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4804	4432	msedge.exe	87
PID 4432 wrote to memory of 4804	4432	msedge.exe	87
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4684	4432	msedge.exe	90
PID 4432 wrote to memory of 4844	4432	msedge.exe	92
PID 4432 wrote to memory of 4844	4432	msedge.exe	92
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91
PID 4432 wrote to memory of 4412	4432	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url3668.elinkfinance.com.au/ls/click?upn=XhIMYaiKxyLRuOFMetKQp34yODrYYMOv-2B-2BFs-2FphN7naDFqFsZv9dPWbh7Kk-2FpvbQadh-2FY8oPhC-2BVFCGIPL2zeF0jYhNF44I8EOykKO1WagO2IMA41Pf3oxKBX2eRfiOsJgLiNqpwMj9PNd95x4lYLaJvYJdPmdlO93GyaamVni19TWSafj2FTIYfU0ZW9YEhYoB3_fuXO7wlL-2FczQyorfHOsKx3TtPInqkde1j5Bci3LpLzhI1hDsw-2Bwsc02qAXRsyV8VHyLSrFn7NQOp0nAOXz7Ha8xFjRB4jUjbvn6DEB0QnzLuebZdzQhpV5NEwYYqS1pIUoohraNB2NESAX94eWjDd1-2F14Yg2i3eb9s5dhGpbrogqx9C4stMK8reDeD6hSWh8ILD9EI6Sj-2BMMgFOggDoizZB7UcfiC4dOubox6USPK8E-3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f66e46f8,0x7ff8f66e4708,0x7ff8f66e4718
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4812519208695651007,16336445480945701825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
186KB

MD5
4a2977698422c3c6e58b664643322efa

SHA1
939e0f3f916f936be7c8c49121d8f245b99cab1b

SHA256
d60610d21436821de350b6e21d3915e5ea1617d97cf20f7aaa1d5ae782cc4cd8

SHA512
ca9d91650de72ff1faed43344dbc86ea3e81d4fd615b89347d31c7676fde084ddcae30a9dbfa3b341ec32b00966004fe7d6d96e383b18363ebd8f02b982ffd57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
400e1a1769de1b398eabdd060f52e612

SHA1
13337fca1b9225064c3e236402bf101965ae7ffd

SHA256
1685676daa9686578c1488a79a269eb7b0b94ddeaadf48b90fe12af1e266915e

SHA512
a79a33fcf8c6bb93d9260baccafbbfc5254f020d491f94a25d47b2482c5a5dfe8f92ad0c1ee8cc04c04d21a9ab6bd5e710e68ab81df045938caa62edf129149a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e2579fd3abc58a8ec0202a2597d9d2a

SHA1
7594958323b6507eff556672b59af567877ea327

SHA256
0ba0a6c51881c537b4b855bec75b54b76e36952eb37585df2bde5f16b67a448d

SHA512
d27697ec1e5a7c335157358738db0a940561dd06b6b8284ed499fabca575028f849d6d2daa4b91cdfb13ce414d1c78a7382e71eded19bd07cdc0143c7a91c69c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd5e7471821e53166fae2620ce33c1ef

SHA1
dcecbc7cc763239c60a7a6f6470f18f29e8a5e27

SHA256
818093010dbabb2165e471b46d621a1fc6e40d25d50ad832747716d3bcd0e281

SHA512
958bde41765ebe36a1377dacd8614625539fa66a5a94f2221b94ba0a176f8355617c927ea388f05fce8334a9edf14fc21033e6b381eed8693b29005838121534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc9bcdc9a85990cea10935c45e459d07

SHA1
6d3cba23f4de8cfb688a796f91e62bed7557f93c

SHA256
9d529b10fbcc84a908628020d28bbc19901207efdd7a2679af92faf983d89751

SHA512
8fe7180cfe85f19611ca8a4aae71f13d319394274ecb288a5dc90369f52ac50d8df156de31a7f88a38cfee31ac18bc1db896c416ccb185ca7e99fa8960f52e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34f2d72bd16b5c013e7923007ce6ff24

SHA1
1d3f76c63f256a709a47d25e69c7b6a8b60913d6

SHA256
0bbf5c5a94e9b6fa414fbcffff80c2f98a71177c99793ae1172493402cbdd6a5

SHA512
54f069053e095823bd3e410fd182d7891419a919aa36c3a6de3b53c0388f298390f988a7295dd487f59ad85dd6e603e31f53b37c6f997d058aaf6178c730d852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
31678532b08240cfcf198334836c8724

SHA1
40fa14419b82041c2a7d596aa22f732fe5b68e65

SHA256
2468eb49edc902a8a2227d2d03675d0e331bb66edd4da7788319e42e54e9026c

SHA512
b2b5ecbea08c1ea1fe351204697007002bb7b52deb49eece437a56f542f9856dc7ce1f7dbe359c16b0cbd3bfa048f28aa4ce0a9568dfd62a5db3888c5a8d89c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f7c9.TMP

Filesize
371B

MD5
abd8c5355a150496bae3704984276243

SHA1
7c211ce236dd68bc1dfec1d34f0dd336fee2d8a6

SHA256
490a0b0bf6ed220d454612cdb4498cc582f0b0e63024403480b6b05c6680fb5c

SHA512
ce4a5da0fb745a10ea6705610b9ac654050a7fc3074db8d8b0a7027ee8183d95050fb723480f25ace7768858b7a3d398eecc00626eb1490fc2397f5b8de6d8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
db7a7da7f44c84d13862e0b334ab3e2a

SHA1
118e3be94eadae7a7b995d67863ddd5029606af6

SHA256
7ef2b0662a2eba0ebc6cdc9ac00cc591e68b3680d77ebb22f81ff254bdf289f4

SHA512
de74a3ccf07b8a5c848666afc4f9e436811c6a8794aef532e253702a99cbc8e0ed9ed9a39746b87c6f3553975b422feaf0f699404e42aa413ccced70560de390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8dc0bfd79700cb867659edcc4232c487

SHA1
07e873b7f76977ce1edb1bcae367d28412ff0262

SHA256
9ea9fcf79e692f872d3508370a5aa1caec4595e4a87e6a5a509843e26f823d16

SHA512
0a0d96d6b65d309863f9354e8ba8d2840bf27fdebbbd1821ca38fb041ddacfee359cb86e81cc31dbc53bf0211ec728045dd23d58cc925fc7094612cfcbb26ecf

Download Submit