hxxps://xdpj-yvpvc[.]us21[.]list-manage[.]com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://xdpj-yvpvc.us21.list-manage.com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
3516	msedge.exe
3516	msedge.exe
4860	identity_helper.exe
4860	identity_helper.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4740	3516	msedge.exe	38
PID 3516 wrote to memory of 4740	3516	msedge.exe	38
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 1364	3516	msedge.exe	88
PID 3516 wrote to memory of 860	3516	msedge.exe	87
PID 3516 wrote to memory of 860	3516	msedge.exe	87
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89
PID 3516 wrote to memory of 3520	3516	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://xdpj-yvpvc.us21.list-manage.com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff88f846f8,0x7fff88f84708,0x7fff88f84718
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2134840792794694746,16779627744441665233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4040cdde556a82ccf1d22d860c09a523

SHA1
838c60710816886400cb472b2e1c53be9ea4aa21

SHA256
8f77a6931fad61391e22ad2a08d133d915f084db332c98d3a16bd4791f1fea3b

SHA512
e0f1ba47b7110a17fdcbe499ea3baf71bf53bf08f631ab0de80d9bef6cc1c201a797aff942402a863a49ec3b7d61c156f6c696a8b6b72c2b3e9aae49e27e4e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
715B

MD5
521359d96ce726068814813f9bd3d7c8

SHA1
01e8c9ff53edaf6564e0be6116c41563970b19a9

SHA256
2436fae49153c4a68fe6e67d6c19243e17959f9d6c63150a8cbffc983ce80405

SHA512
78be3d990fec3e7656e3cb4a29ec79102454a5ae7bf8fd23d46d6e19942ff97c0fab64223f75abd250705e92faea51d520eb7fc828e5d94b965b30d95b5c66c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
426B

MD5
72f0e2ad123e31c1422e4030d9b39487

SHA1
2e01a0953a48c1c4569fe4e33ddc6c25dd119d5f

SHA256
4e7e65a83a5318e26542043a237a4c3e186558238c8d644d08c41fee15025883

SHA512
c9fde92afa16fbd9df9c3ebd65d16ae5ca061382d358bdd8c3387fe62afc64538fb319f905c6e9c96548ff3bc8aa1c27d9d504ee3c483d5ad1fe62ae3856c574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0554f479b25fa035b3970ddbfc17e76

SHA1
e17916b8d93ad72a949fb7f2acfe9bfab740f418

SHA256
c025f090681017d53ed68de121ee940a6874f126b8236ba26011215516443f89

SHA512
61992bd19f49dac3adbc65890d95f776a9e3cb190f19e245e750e67fcdd7f2e0ac02357fe45214c761deccb6eab9dfc87bbe30155ca8e81738bcc91ef78ef801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a65fa103c566ee923e52f656ce67dc3f

SHA1
ba2b1367f4011dc3a8eaa86c49d908bda1d31e77

SHA256
ed2f8015074524d0418c0318f72d427efb29bbd8739ecb5cac9b625ef9060855

SHA512
598f2a72077e5d82ced0d23c28e01965818c641b41da58a6519663a3f99a1261c7defea3170944e8277cb9527d2aae6e4af4e6f7c63f5189cd83238b1a9fdc82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e2565e589c9c038c551766400aefc665

SHA1
77893bb0d295c2737e31a3f539572367c946ab27

SHA256
172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80

SHA512
5a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0edd07a5246f799e7df522bccd3b216c

SHA1
b7245ef8ea3a627ca8776362b50dc2bc3dce1dbd

SHA256
a748c8417ecc4aa5f464fe4cc91448784538d406f5df5bdc5124bdc55a9a9c9f

SHA512
6719905ba9098fb3fda86f19bbc5881427fc2e030b79ae03ec99c977f5683b6991f3d788b8231948b98a05d3db550a7d39bceceefce25c1298f08a552236d6f9

Download Submit