hxxps://cs[.]mytheresa[.]com/mix/c3/?tc_id=202311201201523757380094&tcs=3504&cid_vcms=6664627&ag=Category&lg=2&tar=TGT&src=newsletter&cmp=mw_42_231016_category&tarea=07&csf=23350070&user_id=507fd0bb65c9f08e7b4b1a0ac732a5d6&kwd=mw&ptyp=namemyt&chn=email&url=hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001vmeGwuYuhdeaKOsIQK3OvkpL5524d-BRDNf9hUDZbu2w97HE5zuA7iX1C-o1oLveQDwWYRVHqVbKa8vQ4FzxAF5a3EEcnXq5SoBLpEgvgtEmuzoi8my4X-bPGe7uvpoa2I0eojj5mZ0XkS1BNvfop7bgHgpNFznB&c=S9yfuO76AYxLFNDOGEUllys8ugcXmbp24YxrhMoPIes17CeSa1yJYQ===&__=/qwer/c2FsamFsb3VkQGhpa21hLmNvbQ==

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cs.mytheresa.com/mix/c3/?tc_id=202311201201523757380094&tcs=3504&cid_vcms=6664627&ag=Category&lg=2&tar=TGT&src=newsletter&cmp=mw_42_231016_category&tarea=07&csf=23350070&user_id=507fd0bb65c9f08e7b4b1a0ac732a5d6&kwd=mw&ptyp=namemyt&chn=email&url=https://r20.rs6.net/tn.jsp?f=001vmeGwuYuhdeaKOsIQK3OvkpL5524d-BRDNf9hUDZbu2w97HE5zuA7iX1C-o1oLveQDwWYRVHqVbKa8vQ4FzxAF5a3EEcnXq5SoBLpEgvgtEmuzoi8my4X-bPGe7uvpoa2I0eojj5mZ0XkS1BNvfop7bgHgpNFznB&c=S9yfuO76AYxLFNDOGEUllys8ugcXmbp24YxrhMoPIes17CeSa1yJYQ===&__=/qwer/c2FsamFsb3VkQGhpa21hLmNvbQ==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4572	msedge.exe
4572	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2056	4572	msedge.exe	16
PID 4572 wrote to memory of 2056	4572	msedge.exe	16
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4892	4572	msedge.exe	24
PID 4572 wrote to memory of 4752	4572	msedge.exe	22
PID 4572 wrote to memory of 4752	4572	msedge.exe	22
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23
PID 4572 wrote to memory of 4168	4572	msedge.exe	23

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cs.mytheresa.com/mix/c3/?tc_id=202311201201523757380094&tcs=3504&cid_vcms=6664627&ag=Category&lg=2&tar=TGT&src=newsletter&cmp=mw_42_231016_category&tarea=07&csf=23350070&user_id=507fd0bb65c9f08e7b4b1a0ac732a5d6&kwd=mw&ptyp=namemyt&chn=email&url=https://r20.rs6.net/tn.jsp?f=001vmeGwuYuhdeaKOsIQK3OvkpL5524d-BRDNf9hUDZbu2w97HE5zuA7iX1C-o1oLveQDwWYRVHqVbKa8vQ4FzxAF5a3EEcnXq5SoBLpEgvgtEmuzoi8my4X-bPGe7uvpoa2I0eojj5mZ0XkS1BNvfop7bgHgpNFznB&c=S9yfuO76AYxLFNDOGEUllys8ugcXmbp24YxrhMoPIes17CeSa1yJYQ===&__=/qwer/c2FsamFsb3VkQGhpa21hLmNvbQ==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3d9846f8,0x7ffb3d984708,0x7ffb3d984718
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,1227152655928758301,5943817072878486798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
26f8219c59547d181c1f9070c2f5b050

SHA1
cbe34c1b41c0d86e1dff1a0bd82b6c803085a39f

SHA256
3f534bb6f67e07afe3baf85bf750122c2e00b86df6aa258e5752dc6c946fc2d2

SHA512
1600ed7fb809d9f4fd571b99e606ac92f0054f684b6b7a3b72ede39d5edaf458cf551c568ca1bf967326bfbdaf2f7178906fb8d15d82c52049fb6c74205c9f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
309da0cfcde418f048fd95503b579912

SHA1
7a704ead385f4b4eb34be79112def9ffdf445ef3

SHA256
2cce70f1416734425616f5e7e349749f4fb174014a925a5e6492a0d5d022dc5b

SHA512
1d4fa12dd9a4f5230caece99d04d73ac879cd9aa1f9fdba8ca07c3fd845781424e3b684411c432473c8a8490742f321513cb6c5e0623329de34ff42ec5eca696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b27ca6a2fea9ce7affeb04dbe48095bd

SHA1
25d40b1e22214f6db38697423fc68c725a7a0a5e

SHA256
fcf76022007e58a6f15b68f93a80573668929c8f294b9e9b9b5650fcf5aae4b5

SHA512
0080c26bf0e529b8be1be4269ca52c4a0cc908a98e3e3a96fe89d4a889ec75b5d89456264bb7e078b5cc4a772090fd2b078b7659f0de29c81d213bb38c92a108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f062160eb4164a17d1e48ecb1e82142

SHA1
bfeb07445204016af3b616cc30f44164ff44bb96

SHA256
65acebb25b46f8f894385046bbae77aa4f9d427c1256d24b1a252afa72a90e1e

SHA512
00b3b5d0b777ba4e79150abe1a9e237f51fe6e285924579c48c1cdd0957ccef88a7b593075a6030e2ac091a64318d78b44276f17b523845d75b120a6005e789b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
7028e4abb4feec52acae5f9e416a29da

SHA1
45ddea4cea8724c1c1301ae7d4652e7d049af888

SHA256
3e4fee798fc660b69bfbb85dacd1358d5081c9570d3dc88a369958f56a9631db

SHA512
b1edebea47609b79881d250fa7016253b2e8a40a07e18b3126ff59be83a75a86c36fc867d9cb9476cb07681fbbfd81fe4674406e490269d8283a4338ac2a7304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
5cf499d37743615d8cff4a5668dcf233

SHA1
81a4147400cbdecca44d382132f7f724704980c8

SHA256
c18c19efc526d9ecec06e66c6d67506b297dc0e7e21957949087061650e234cd

SHA512
54a48beee75b508e157dbec03f8a2550d4d48c78afa48ddac39b8a8fbc0ea7d9cc48506c6b4f247e5275786ef4a1adbf98a3bc7d99a0befe8a207930bdabaffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
95a528459c9455de59e3865bb27d6c9c

SHA1
474ec67d0a44a0db0ba7e300350c7379df9b74de

SHA256
7a64c0e78bc08229ab667c36fc74913ffae966cc89bcdf03213fe98b81c1c530

SHA512
a05e5c8e197c48700af7c7977fc868c375b9ab0a35d766df7b120dde3cb02158ec3287244b0fd088909be8806059e0459a8b907045f813571117dad8db504631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
7d80f1e929942786a8bbe0bc3e1c5312

SHA1
5ce9af71d490078a932ca17e753c0da0657681ed

SHA256
c842254d8fa7210b4a628c0e8fceb9e8fe9a6f1d2775ff4428cfb78438d4e0a7

SHA512
3f57f3b860655489214efa7cc1490957af30449a1b5bebeab571a3d2b10e2cdcf7ff2b5d1dd2503db8207f9024f5b48a398597573e1fff329f6411b6da5f17d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
b9bd364338d71005f7353bd0c1bf2f71

SHA1
74ddfd50308ea097dd80d8934928416dcdbc3368

SHA256
e5cc31d9e068bc2a42fab2e468c52fdfbdace83ab185ea9c704a8d55dccbfe09

SHA512
f20cfd73355e42fdc08a172d1f2db96357247dc6932cf645be350f3c68f83805ab9cf35787c64c962aa3ee823c16a6b6519e081a333b5a31391baa6ab746fede

Download Submit