hxxp://2023-letter-of-assessments[.]com/secure

Resubmissions

24/11/2023, 03:47

231124-eb9hzsgb21 1

24/11/2023, 03:42

231124-d9qcbsfa66 8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2023, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://2023-letter-of-assessments.com/secure

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4712	msedge.exe
4712	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4788	4712	msedge.exe	71
PID 4712 wrote to memory of 4788	4712	msedge.exe	71
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 3956	4712	msedge.exe	87
PID 4712 wrote to memory of 4636	4712	msedge.exe	85
PID 4712 wrote to memory of 4636	4712	msedge.exe	85
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86
PID 4712 wrote to memory of 2832	4712	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://2023-letter-of-assessments.com/secure
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe44a446f8,0x7ffe44a44708,0x7ffe44a44718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1080 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6236922073700862515,16947501833305204002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
20KB

MD5
3d8fb837c8955e6418258bf20d428098

SHA1
81f6b08da7bf258fe71e06fbdcda6bc31b401196

SHA256
c2e04505107f514612c7fa14570c0c47a9c45e9d8a0337639b51b5e7d06a708a

SHA512
024d80e7b997eb42726e77ce2a101687ff5dc5cccb5a738d242ced834a188334da6e8b90b845773eaf914d26e5edb3b4fd1462b431d8688adc6c4cb4520a44a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
3def663407fdc6f69ff27d877aeec05e

SHA1
bc1c14211a842f508df82ce5ef480dbe51f8fe58

SHA256
416312684629a2eea8ccf1313d85a8b3f789fa047482cc3b471e219596f1658d

SHA512
412b78e601079b36ec41176a6cd831dbc2e8fad5d9875066c568723474f237aecfc53fc6d07686871fcf854bdf37ac6ae91a39bafe7ebe4c240558184e55c7af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
2b0780efb912d46da2c163f6ac49bba0

SHA1
41c796080371c8a6ba844e1c6b6eae9c2805aeb9

SHA256
f5f92ff4771385032ad26b8a2878d6a9675edff5b2f419f906879d4033e0b5a2

SHA512
8b2eb156690aeafb806ced3a212b477249f4e534ac50e458113473a42fcf7825cd45f3114dd01843eacaf7f826c37cead758f904465f46ab10054c0f3584b98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
944B

MD5
7ee977379ba305ebdbc17e1885c736f2

SHA1
f8ccc55bc9f4b6c3fc3ea3b261b8c5eb8be93572

SHA256
7521f2103c41ec075b1d247fd1888929e8159e2797c11ef74284ad992e94512a

SHA512
adecd12e1afa796596d4b6661a3c818369501afcdadaa88fd0fd4cd07fdc42cfeb4c3086a3aec42d12a412ae7135d6ce86298b8b6f432881939d862b0a8553b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e50589cbc2bb064b8cfa5bf3f251af9f

SHA1
b94d0f905287f28137eabfe4bb6588b4cf1590ec

SHA256
98442906fc79c2a25fa5ab89c37db65e12a7688a87647786cbffa60d43e4e8b6

SHA512
14e56e311cb173f729ca02ff14e792a83355dce2d0885c49caf5de9f9bcc4a2ffaee2cde9a8b122f76e41a98eb63fbdd62be87e25be86d5313641bed9239f516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c96fb9cf189f9e465a84016fd761de1

SHA1
fbd3e3b4a9ab06001edcd93362911fad30a138a5

SHA256
21124fb4bafa344fa085ff50f68133213f37e674b13da5fd2cf08921247571d0

SHA512
82a88352bd734193fa96e6dcdb7000a0245ea163aab0fd333688ba3f39f2b7b98fc7ee90f688e466569c9ba57f4823f2d62c843e623e091b35a622d1973d0622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a1877008077ea58b395fc57551bf8c0

SHA1
cb8b9e5a8528d64aa336853c12b0e6d4adf0570d

SHA256
a0dc517ca0f50b1d63e963a724e569ebe20b7fc0f635fb8c271306c37d238ebb

SHA512
0c17ad41a1d7bf0805f08d1fd15366cbba3bf559b43c701b1e54ff80a798757d9edf971cb36bc35de463387fe2edd304b13fbfdf75f93f67c8614965e7a7cd19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38e4e3eb610005c7beb7bee96980f134

SHA1
9e4b06cae2ae992eab46e86fdee7bc3c63f1d2f4

SHA256
a34162636de5ada931a7c47f3abdc68573ee5350ad5886ce04d3beda6c6d46d9

SHA512
344336e8ed474b64e85f006d54b7527dd8a1fb9095a94c56953ca16a4a883a656e83e5b47a53bb8e2dd3b7bc96b6a5a8ac4ca4e76c99cefe73319fe5267ac22a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f78d72698164bdf3ac2f1a780cb07211

SHA1
c65ba6b611e25635714eb5ac732cda6ebac2e2ec

SHA256
24fca3d56fc597368fa0eeb7b0f70208291bffca21eaccbe716193a81a079c89

SHA512
cd123bcf6cdcd7ae905161fd29632a751f1229f7e8dbca474eb29dc673943f2c0580490bb9e97867b16c29ab197cfe790c5e95e24b843e66d013947cc951257b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4757ac019bee8f09cc2c889b409768c8

SHA1
4f5bd11a3852ed2b45e39f60d5749bef60f7a302

SHA256
47c25af644ec057a5a5327c89eeff007877c0c5671004c9a8aca7c5864c36dbe

SHA512
5ddcdd108ab816bedf059ec197ab173162b17ef2318876c1d51751d44e99b0ce57efc1e53ef8469d7b8ad0709ca3f3d14f15168aa7cfd21aba0fd8854ab2c805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
200d7b6b9369f20394ef20e5ef328464

SHA1
8d8256aa05ede17ec578b9be511858b158d92d43

SHA256
07bc7728c1dc03eb5793ab2e2bb00ca08256fc964450f180def5cfeb7c0b1fa0

SHA512
96549a3d02d785a7696b7cc1e8a5c98f36524f59cfbc656d80e9d06da02c9b1a311984dfd27de3882c69ddbc959639a446d8528bdc314e9785ebc303be91d983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a51e2353f759aeb9a5b08eda94e66000

SHA1
526aeca1865f6d4fb05e7047780c8e761732e635

SHA256
f3700a3c856f0beba3e5aab4af8fe09ebc2f3faff397234a9090d1cf0bfd4091

SHA512
40ef74b2f94c296b773abe7226533dcace95e1a2d588e8944d652c038ae1eb713d3f4ba215de2592bfd7959cda81a423b61ff7feceedad495d64518c5ad25c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d74bf7b42f8b26c5f945d46ebcccae24

SHA1
27b363844a5da599f136a456fea2cd29b1b4c8ba

SHA256
f3dd17be462c75adc795316025fda4673dda077f55b16548908b2b1726e17e5b

SHA512
72b0b1765da9de9dea55c39cf7f30d715bb3bb7c263bcbb6d7eaf75d0ea097c239c0783cb8824023934190a5892f63325fd6f1336e56be1c88694e2a91251fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591831.TMP

Filesize
204B

MD5
bb24412801fb8772f90cba8768b3a8d3

SHA1
105b50d0e6b9433f76c44bb744f80ee319e0a9b9

SHA256
266a8d605b39eea69ecca1ccfe388af8f7c7faa0d0b16b6b9726921e3e3d07a1

SHA512
ffc512e22b654f2242869dea20b9bbb984ad75041faa263dee757f61b5c03f22f84a7daa815990898f49b872a50499717344e3aba66fe67280717c5ef5ca3937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d146684cff2acf8bc21454beac8d7118

SHA1
3447c1da23cb1368409a5af1d54ef97e4e33fc77

SHA256
90c8f086af9ca432b6884273403ccf67d18eaa3cf232896d7ac2410f608a7bc5

SHA512
bd9f3ffd581f3eff38f9b00193ee0d449fbb08a1bbc6f9f118e54b20632f0a3cc292f99b24e8d59b730cf91599ad366057e4af37de79a0bc6a6af6ddb7bd4cc4

Download Submit