hxxps://customervoice[.]microsoft[.]com/Pages/ResponsePage[.]aspx?id=5zuboSHBYUqMbrL0bg9gtyTjAse26mtIqcteYqbMLVJUMTRGMFQ3ME5JUURBOThDUFYyOVBCTzYyUi4u

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2023 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=5zuboSHBYUqMbrL0bg9gtyTjAse26mtIqcteYqbMLVJUMTRGMFQ3ME5JUURBOThDUFYyOVBCTzYyUi4u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
4700	msedge.exe
4700	msedge.exe
1396	identity_helper.exe
1396	identity_helper.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2576	4700	msedge.exe	14
PID 4700 wrote to memory of 2576	4700	msedge.exe	14
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 2772	4700	msedge.exe	26
PID 4700 wrote to memory of 3900	4700	msedge.exe	22
PID 4700 wrote to memory of 3900	4700	msedge.exe	22
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21
PID 4700 wrote to memory of 3952	4700	msedge.exe	21

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8344e46f8,0x7ff8344e4708,0x7ff8344e4718
1⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=5zuboSHBYUqMbrL0bg9gtyTjAse26mtIqcteYqbMLVJUMTRGMFQ3ME5JUURBOThDUFYyOVBCTzYyUi4u
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,908283767916946903,2489977131278843745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f0cdba3e639a70bf26cf85d538ce1a8

SHA1
b457faa0d6c55d56d61167674f734f54c978639b

SHA256
c1e48c2dfaeb607efc713e1b5c01d1ee8a9491d8f3a2a5f4f3887e6c1f8c2f63

SHA512
3c270fc58170c37f51427aac2d3092ddbbc17832556718612cebb0c32c04e7e3b7e157969d458a4b9c3e8bf781c23489319338960cefb5cf530673f2b8f81609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\111ac9cc-4c63-4361-b1b5-2f935cf11e7f.tmp

Filesize
538B

MD5
bfcbb55ec747d77297efe2d2aada253f

SHA1
361c091729f685473ccfaa591a9b91336a621b85

SHA256
462b6cd35834f26ba095e2231ba33c79213b7cac64f5b02a60fdfc875f2a364d

SHA512
dc54d3fedb206e437da2bb0f78dbb5ab2f0b0f5ba77beef2a9196e1fc1232d1d2b5946233afedb7bff9fc174ff8cbdb0a9809b2d0f8335baad63ab35f56e2dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0cc02a5d32758ed63759ef282a09411d

SHA1
32890c4da13b860632e418d718a7b5f609ed5bc6

SHA256
60c5533f82deb8633583ac500973065e0ca9ca1c4ffbbe7cfee8c51227ce6cf9

SHA512
6460b4cf8727d109d4c6ecd447847486a7bfbf90e7d0860098c8d1728306217fe9c24f192a5127ecfb2fadef0b7ee7af2549e4f310a62c36e3b9c7205e4b5098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b14e1a3dd064415eefb419281ec11f3

SHA1
cf036db01a892cb9f1e6e10a368a0ab2568b387e

SHA256
d72de8d86c470c4f38e3dd1dbee0ab62a25e26840dc29a97aeb51d4073f548f8

SHA512
f040aee3731e82e2dffa3f25550b3bea5e2d2f535a64b6ce165cc5aea7c3e3f8f69bcc21fea04a4a31b5039779895e6043c8843a05d94a370064015d75d46d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
843B

MD5
0edc5f77fe70540d57a09c04ccb8da17

SHA1
ff4630348e9075940fe30f271d64f8dbb195619e

SHA256
888006f775e727866b44a1535a1a710cb8eac2e5166b60c5f75d77811e8f1b62

SHA512
e9598711e79375f9204e6c4e095a1b2ffa053ba2000739d20778f14888f2fcb11cc7b70d4be986b17385a83d5ae15bda12fda7cc1328b16ec7da3fc28bf24407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
747407ff2c0aa26925c60d57f4befdaf

SHA1
478a83d956f748dd7383d3da97d53433304d6e80

SHA256
32c38d4eac24547af3415d7690351272fc6d43e7c5624ee6d7560b435f0ecb43

SHA512
d207d06205699e174e359d3e605d06543b2280193a0d0f81682b407d9cff79b16bd5de8f6aa6e06114e4d31926d39a8dfddb76d92c836b02a64a107cafc87c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4dcac0a8b6a8c0734c9777d90160798c

SHA1
d462d79c2aabfd736449d6bd085608c4834dbf5f

SHA256
77bd52fd365034bfca0bcc4966313c9515190c5610ed13cfd80816a4a92b9e2a

SHA512
1e2d87b6f0c7e2567883cc688b14ce17e48d08fb74cb09cbaa343294f17288bcd11c44ddb378f1ed0424080fe42efd6f152d6b70d9a4e601e1ffc330413aeb2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb613d36574e421033f4a257a679f871

SHA1
afda7e607f3e543bb4d4b2636128b7bd75a2b98b

SHA256
4803a74f8d9529e28fbdfdd6486655e3d3c4326a76cc7604450cd375671b7759

SHA512
d298d7a2c85971fe2539bfc88fc9f4e8a3e6a5fc192ac08c6ccd07e3b78c0e84392537ade139262f6eac8bcb3aa848792d11c1cf6a7e74368f155ca9d4c7b24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8f472f5706f7f7e9508673402592ad03

SHA1
18e3a5699bbba3203e3876d0d28c560a5e6a9c03

SHA256
a98515127ff6537a7c2249265c6f4385320472a03127dc3d47c0d19eb2510d09

SHA512
7f1cfd39e3e078b180c6636822265565d07ee13929043095db13cfbadfcda476893244184aae3b204eee4f46a481e317455a8a96301982faac30ae3a82898234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578f40.TMP

Filesize
538B

MD5
06ab7444ccab1f6cf65aa55fb385d266

SHA1
0d871bbdee37a54e162a83ca6ec3f530176658b3

SHA256
da63c487bcd74a34a4f16fa7dc91c9272659cc226faac20ed210b345748a8722

SHA512
b2beca8a6f9d7369f6bf8294ebd2f247b6559763cc5a8358e92a9fccc513d4e40d41b8909177020fbdeed5ef0cf026057884543393f957b1667217259ded1f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4585a1dec2f5873ebfa76c44cb7ba08d

SHA1
df049f5d9b8e617a99cc8e18e430734a7c3dc2aa

SHA256
c7d0af5a5640a37c892f24a08772afb1f621c3b0dcf119b510b797ce2989aa99

SHA512
2bfcbf901ffa455ce862622f57c4892abc2ed9421b4d4cec20f3f1c304379ee1e5a28e2221da5bd98946cfc6038ce43e5ad962cbf2248ceb984ee0164c529576

Download Submit