hxxps://usersdrive[.]com/ifxcx3oocq3j[.]html

Analysis

max time kernel
100s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://usersdrive.com/ifxcx3oocq3j.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
5080	msedge.exe
5080	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4860	5080	msedge.exe	85
PID 5080 wrote to memory of 4860	5080	msedge.exe	85
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 4436	5080	msedge.exe	87
PID 5080 wrote to memory of 1228	5080	msedge.exe	88
PID 5080 wrote to memory of 1228	5080	msedge.exe	88
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89
PID 5080 wrote to memory of 1420	5080	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://usersdrive.com/ifxcx3oocq3j.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8544646f8,0x7ff854464708,0x7ff854464718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6954802171832630170,5533310626996687806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:6112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
186KB

MD5
9f61d7b1098e9a21920cf7abd68ca471

SHA1
c2a75ba9d5e426f34290ebda3e7b3874a4c26a50

SHA256
2c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71

SHA512
3d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
0320f4ff9a5e7f2aeec01de0fc2e27bc

SHA1
d37dd559cf012eac1a86a59e9cbe16a1d38e46e1

SHA256
a99e710d76af8a9b6d89a4f04f81b0c497da3e0b3b168c801e0ff6b883d0bcb3

SHA512
82bc7bf53cc8f8fa9995235e78bca8f55fec8f1632842f309f33b21fbad218c5071af8f03635b9798ec3732fee830bf71bd8ab7b8995c9fb43edcaf755ef78ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d72865e159553b1f20760e01b1ffcb66

SHA1
370e1c455ef41ece1603ba2e0f4bbbebd85dd11d

SHA256
0bb4fd7f21f93825e706038313d409bdebca6765fd5bfbca0ecb8bfeef276a8d

SHA512
84da9c6eb4b047087eff13cfe0f8b49ab77718c511461edaffdbe7da9ff4f48954b4ea69768967dea97bfa5a934dd54e69f6e6df2073860942aecdff835d3ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7d546c712a293f62ddf91bcaa9e9125e

SHA1
cc6d1f31fd45dc9d29070f812ff45967c58e4385

SHA256
a8a94de283f750f2ee7eed5b1de0f6e1f90cb3a6e8c52798772a9d1d4b03d6ef

SHA512
7ab0d2895a917c40e984cb088363b071cfedee0fbfbdf639c2eef3cf95135c4f93b310811691615da9d1899db35041d937353e5d1dbbda7963f774c70fa942ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b2e0332169e639bffefbf2d9b3401476

SHA1
bffb1ebe591aeec2b882cd566992900898f7be9f

SHA256
10e761bea6124d655f004c9fc901b5cf041d8aa51328769041a43a47ec14910e

SHA512
9846ed833ac4fd947ae472d2b8a19fcd534455a7646c554f0f2b48c74e65527d9a5e329c4ae5db16c52e1eb97e47c9203f2d4b067acff4ee930dc22b48f2d6d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c21e78c2b252af2e5acfb61b659f8e0f

SHA1
ae76829b55a58bf8af5fc5766350dfad0023cc6b

SHA256
a432e9171159b2913d2040180a0b85317b9ed29288258e59821f4be3517ba97b

SHA512
d9ffb9be1b2db5ecee94d35b98b4a9af15c008e7ae012fb530403a12d1ffba34b53bbefed9aef75737c6ce7c30ee04fb5ed8ba457f72677d9b7144c70f60d90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a385d7247a5496b5a7ad5f1f07792b1e

SHA1
a9dfbd6d823d2d0a5e5752290af040f13c49436f

SHA256
bb72df82ef9a4c002e01aee71812c2ef1663eb95964f46a663adbe1a4b110984

SHA512
332cd5a813c48a92bd035bb154f780731617f6310733f3d4e28ee3009e7d85c489daf74ea5fd2545d3407355fa831292c83d435c0f7bb986ad0c9dd392f228ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6357e51d9521aaa82e2fe136dd48fdaf

SHA1
6e5d9a0f37908a40d8c3325dcbcb4d229ef9891d

SHA256
c2afd1e6f2a4e417648a674107840c7c3f67a5f68f7f28fa937c3b15e27fda61

SHA512
0ab33f1e332e2e4d3fdcb3b6a854fce757e35826c0dc38ff837845c26b375f3a532854d90e3486829ee3d47b60606e2d4cf4865cf3fa895b5832c3a589ab3a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b630a310e6ad90e0288ce3976e2024a

SHA1
807c60bb58d3b588adeeea25f47e91d73bd35ea0

SHA256
22ba7afa6cbebb528bf7ac0764ad75c9a39c1eadc12d4d2b2729e374f8672ef2

SHA512
866203b5f8fddaa43d1a08e58e8627c12520ad0e164d9e771d96c58d1461660099b8a65b6a0518afd2a3e3549c3bc8f5f4b1f41e595187dc055036f440fbd017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a42b05ab0c6cbf28fb4cc2c5ba309c0a

SHA1
45a2f4cdcfa9eca6b485e78c97fa1f4b1671b4e2

SHA256
9c198071e9b44e444f03e828d5f49b4b976fa65c4775c8ae1e124d09ee6e3dec

SHA512
e5000c1a0a12daa85ddc6dd8d09099b980043062544a107fae339db5f497e26e30889fe630ad33a46399c36f6aa0df7d644559be8efd6ba12fbea2cf08d920a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c33bbf778554e272baec28bffc276e0

SHA1
b0a7ef359e38b911deab85f7ba6e48db99d2c257

SHA256
08c53b3e72833828f41ed5cd47b5a815b75861e8a73e4d59cbe75b3118ceec53

SHA512
5c347536222b1e1005fad7d36636869de3721e0b6e0da834a2af5ca57d7559f9a9be680635ddd4c92bebb5151d4a032d6a69919ae3edd4cea049237550922645

Download Submit