hxxps://www[.]yumpu[.]noclick[.]com/de/document/read/8941833/stand-317009-laborprojekt-hydraulische-tu-graz-lpro

Analysis

max time kernel
123s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2023 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.yumpu.noclick.com/de/document/read/8941833/stand-317009-laborprojekt-hydraulische-tu-graz-lpro

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
4032	msedge.exe
4032	msedge.exe
4320	identity_helper.exe
4320	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3908	4032	msedge.exe	46
PID 4032 wrote to memory of 3908	4032	msedge.exe	46
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1460	4032	msedge.exe	85
PID 4032 wrote to memory of 1848	4032	msedge.exe	84
PID 4032 wrote to memory of 1848	4032	msedge.exe	84
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86
PID 4032 wrote to memory of 5028	4032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.yumpu.noclick.com/de/document/read/8941833/stand-317009-laborprojekt-hydraulische-tu-graz-lpro
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd96fb46f8,0x7ffd96fb4708,0x7ffd96fb4718
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8106292734538151560,11458156942394182485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
19c1159f59ab6778064e23f175be9078

SHA1
f269cff6cc1ce1685074167cef618f39f442b26a

SHA256
3c621129c55d09635e87a4604fd280a498abfb5f90be2a2da70823c38b1f6dba

SHA512
7cf710f6b18c832b8fcd960b4680433d28740bbd8a2c945ec5d0d8e632f2287c3a86a95dacf522d05b94ef1e02b3515598bdb86c80a36c3346528f4c21aab932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
de3a28ea45ae870cb95211c923deaee8

SHA1
dad019787d0ff39b586f07595e281d7d8e2bf825

SHA256
135dcdb9fc6646d3cfd1283e79e0912f1684c0465c24afbcc6cb6cff34a42f6c

SHA512
c3b712e6548b914f348fdfa18b50a8b2534b81115d4cc65a0bb414532565db5293d7fea2e595f038eb8a461f3e5d32a8a80ce4ead775ea982d1cfe8e1c77b796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6809e2b03377bc7676e50979424916a6

SHA1
1b5e81693c362375e5ce6ed55091b68c39ef5f17

SHA256
24672b3fb456803f5cb010e12d3e6112be604c6bd4b5e8409077c7b638150228

SHA512
c735d71f7b45781facdcf183e988eeb87dd58268be8d671e89e6a4411285441f9b3707cb3fb942911e3f950dbf5062d19d83ed9eace0da89b1c8ea9a4dbb3676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba89f1b04f64b2abfd4d860f37d296e3

SHA1
f47e212c618e5f5cd689f5a078302d5fb2096632

SHA256
f9e19112911ed3998bf253d7e44b16c7328019428f73e365a07930d30e09bc69

SHA512
bc6819b24e0d948df181fb7eef8729d402ea355c0995db24b9f227154e4a3c5b66ebd3d0e4b264974b05264eb6549f6aa4a0ee4f2bfcd8c8b1a30f2da9fcfb08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f57f9f926f1da8465f8074077ff384ed

SHA1
0a1e79a9f09b2cbb69b7473b0bf2dfe120b2f187

SHA256
0790aadadaafbefe7592828f642956bca95b4c8e84b587c41e3592ca76376892

SHA512
78a5582795053ae8e17504a20353f31611d7c07bff9eca14c47380a5390ac16f890f25df36dfd6f204c04e509883157fa6bb5a57c33a115e95c6af5d5d4aca13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
335c8ba31b5d4f9f3a0402a3291ac2a3

SHA1
491f10e97b1dbc3109861c80555dba870b1192fd

SHA256
4c70c7621efe1011913d0d7068e46b03e35abbd2ca59b7184f6a431581507c30

SHA512
2bcaf318be382a7cff35195e2979de4d5958576d608f5261f268a089c9e827ef4dbbaffa715b855f39d3adc5677c3baeb9ae2449d579168897a963c0febc591f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7b0ef0621534630e3068324ac49d2555

SHA1
b96a56b79be985d85697c721a20b1afcdd4801fe

SHA256
0c98b18a18b33bfc23395650fefc47c8e6f8ba634c081f73206ada2122d8b137

SHA512
0019e2a7e3760513cb0a3f78cd318c2406ed9192f24e2a106c6924acebd87b1a4db1a6024ec25a1093cb9578fd09425f0449fc96d730bcc82a1f9c4941599b63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb1026cebd4e6887207fb3833e2ef520

SHA1
6bb2239c3d1c37e39f164100bcb27dff353fda7f

SHA256
c170987673c1efc15837e617b6717f8b7c81edef123d403e27adfed03e69b16c

SHA512
0bb2a03d4b174589349f7d0d76b513eb74eef40eaf792ddaaac4bf2040375b98c92c011d3cd64295384b30d7859095c09328b1a5d947da883fab37914a154065

Download Submit