hxxps://us-east-2[.]protection[.]sophos[.]com/?d=rs6[.]net&u=aHR0cHM6Ly9yMjAucnM2Lm5ldC90bi5qc3A_Zj0wMDE4T2RSZGs0TXVuLUkySEZCNGU3bkQ5YXBLWDd5Z1psX0VzQUhRLWJSRHdzdURUOFc4cE1zUTJYRElubHFBNDhDaW9oNzhBTVRSWVFDY2FoMVlCSkhOWUl5WURmb284UFFIMHZ6NG9zblc0akJQZ1BYNWxlQmJqYVY5QTdBYy1CcWhxZ2xMOTJmcnlFYmlmNGdFajhzWUxOdEZsX3Q0VXVkOE1oMi05ZnRKNko0WER5Y1dXRFVZakdnazJXNGVnWjImYz1paU1hQzZfaEJBRkdiWWdGR1RNak1tME9wLXJMbHhtSHBkUy10NGpKaUtzT3JlTE1uY0dsR1E9PSZjaD1Ea0h6czRTWUk4X3NzQjVTUGdZUWF4b1B0QWxFYlNycE05bU14eGVkdGJwTm9BMmM4eXdja2c9PQ==&p=m&i=NWU2YjkwMzE0OTc5ZWYxNmZmZDNhMTM0&t=enlQbjRYSFBlZnFicTI5bXk0NWR4TDlaRkdxdkFzbGFJMDdVYVM3RmJlMD0=&h=dbeef616f77d4c91b714c6c6dbb7c249&s=AVNPUEhUT0NFTkNSWVBUSVZLSNYC7IGBGD8Fhn5haivCgPvM1U98BX8I-yr1S8QACBSDgADUfsD9Iga5d7ny5OpHmwSH23VnwRERhsMOWevnQHMfyYSwpDEw8fWuVrMoUmsBdVqZf2-O0BrhQHlBVGw

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://us-east-2.protection.sophos.com/?d=rs6.net&u=aHR0cHM6Ly9yMjAucnM2Lm5ldC90bi5qc3A_Zj0wMDE4T2RSZGs0TXVuLUkySEZCNGU3bkQ5YXBLWDd5Z1psX0VzQUhRLWJSRHdzdURUOFc4cE1zUTJYRElubHFBNDhDaW9oNzhBTVRSWVFDY2FoMVlCSkhOWUl5WURmb284UFFIMHZ6NG9zblc0akJQZ1BYNWxlQmJqYVY5QTdBYy1CcWhxZ2xMOTJmcnlFYmlmNGdFajhzWUxOdEZsX3Q0VXVkOE1oMi05ZnRKNko0WER5Y1dXRFVZakdnazJXNGVnWjImYz1paU1hQzZfaEJBRkdiWWdGR1RNak1tME9wLXJMbHhtSHBkUy10NGpKaUtzT3JlTE1uY0dsR1E9PSZjaD1Ea0h6czRTWUk4X3NzQjVTUGdZUWF4b1B0QWxFYlNycE05bU14eGVkdGJwTm9BMmM4eXdja2c9PQ==&p=m&i=NWU2YjkwMzE0OTc5ZWYxNmZmZDNhMTM0&t=enlQbjRYSFBlZnFicTI5bXk0NWR4TDlaRkdxdkFzbGFJMDdVYVM3RmJlMD0=&h=dbeef616f77d4c91b714c6c6dbb7c249&s=AVNPUEhUT0NFTkNSWVBUSVZLSNYC7IGBGD8Fhn5haivCgPvM1U98BX8I-yr1S8QACBSDgADUfsD9Iga5d7ny5OpHmwSH23VnwRERhsMOWevnQHMfyYSwpDEw8fWuVrMoUmsBdVqZf2-O0BrhQHlBVGw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
1692	msedge.exe
1692	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 5008	1692	msedge.exe	30
PID 1692 wrote to memory of 5008	1692	msedge.exe	30
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 1384	1692	msedge.exe	90
PID 1692 wrote to memory of 3060	1692	msedge.exe	89
PID 1692 wrote to memory of 3060	1692	msedge.exe	89
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91
PID 1692 wrote to memory of 1664	1692	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://us-east-2.protection.sophos.com/?d=rs6.net&u=aHR0cHM6Ly9yMjAucnM2Lm5ldC90bi5qc3A_Zj0wMDE4T2RSZGs0TXVuLUkySEZCNGU3bkQ5YXBLWDd5Z1psX0VzQUhRLWJSRHdzdURUOFc4cE1zUTJYRElubHFBNDhDaW9oNzhBTVRSWVFDY2FoMVlCSkhOWUl5WURmb284UFFIMHZ6NG9zblc0akJQZ1BYNWxlQmJqYVY5QTdBYy1CcWhxZ2xMOTJmcnlFYmlmNGdFajhzWUxOdEZsX3Q0VXVkOE1oMi05ZnRKNko0WER5Y1dXRFVZakdnazJXNGVnWjImYz1paU1hQzZfaEJBRkdiWWdGR1RNak1tME9wLXJMbHhtSHBkUy10NGpKaUtzT3JlTE1uY0dsR1E9PSZjaD1Ea0h6czRTWUk4X3NzQjVTUGdZUWF4b1B0QWxFYlNycE05bU14eGVkdGJwTm9BMmM4eXdja2c9PQ==&p=m&i=NWU2YjkwMzE0OTc5ZWYxNmZmZDNhMTM0&t=enlQbjRYSFBlZnFicTI5bXk0NWR4TDlaRkdxdkFzbGFJMDdVYVM3RmJlMD0=&h=dbeef616f77d4c91b714c6c6dbb7c249&s=AVNPUEhUT0NFTkNSWVBUSVZLSNYC7IGBGD8Fhn5haivCgPvM1U98BX8I-yr1S8QACBSDgADUfsD9Iga5d7ny5OpHmwSH23VnwRERhsMOWevnQHMfyYSwpDEw8fWuVrMoUmsBdVqZf2-O0BrhQHlBVGw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe76a46f8,0x7fffe76a4708,0x7fffe76a4718
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11763982033099398766,16206821394815941931,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
456B

MD5
5d2b153cafd10021e1ae0c53dc5182ec

SHA1
fa4b06dbc4e50d2d2534687eab5d542807de93c2

SHA256
8649023dd6a9a9dd8d929b90b67a9f52d03cfad0bc5b2482d11314d9a5e1adf7

SHA512
3c5128b91e427972c020ff85f15ea7ff7689f48bb0e57fde973612d064af2ad4a0c568273a73e72493c83f339b5e24bf950717660c6478e712f7f4cf07fc5f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1743ebc15dd7220f6300b786aa1bff5e

SHA1
d44e43cb99959500a175a8dda10617eba9c17940

SHA256
a99bb18823c8ea2b02cb1e4681e1c094454a84dadc990f7a94aa02e2e2d146ab

SHA512
7156ccb6e13c44d7394b82f231e0716a17b18f12b62a9815d171fbaf9862b0fc96df63e117b548bbd9afd16bffa900ea957b4db73827ca81bb1e89f46c3fa6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5df18fd923c3ff34f4f56cc006ac036b

SHA1
30a454de0b1530daeb84089f85d7a73345b6b7fc

SHA256
b9a0efe5d6ebf67707835279c37817124d4cc2860d6685fbc61f320cbd02ac3d

SHA512
4ee1b5162d7712dd38ee55eb13210b2b861a46e5c51fb274e807a27acd129dcb339cc4c97cf104a34d091b3117585748cc5b4b9599e5ff09a4b8da1315dfb3aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
45b19c81d5c1c2cc716ef3cb6704a287

SHA1
96ae5e377461fe2ea6b00514a0f09b1eb3703625

SHA256
baf4231b7ef784badad8c1a1a34a0a51bf252beeb81c9a11abc0f5cdce63ed17

SHA512
e9097cb5af50e039e80d99490479ba865e68270e75fb3995c4bab83bd9c21d63a88d8dd4ac6ec74875ac5e843a127434c11cd3f9f9bce96c17f8ce42d64a831f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a05446e2fc74ff1cbea122c1ce9cb6f6

SHA1
e3fa749aea35cbc87cb3b2290b50a051f214bd13

SHA256
019337cd58e77c4c2295aae31080fd55d7d8b92265ba0828bbb5f6a3c44aa052

SHA512
a3269acf23049ffbbaf88f9e20eecc419fe754036c82a00ae12cc8ec5d0c447a005debacce6fd0751d8fa43d80f55c8fde5bcf011503ebdea12f5de32e74a77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8bcac2a6fdb0dc4be4e023bc169ef12

SHA1
b7e3842059b0489a5e97c12e85a2704a7ccf3466

SHA256
b2299418434986a04bac2b1242a6f8979646a91faadcee9ac454d9c313db70f9

SHA512
fcb3bc942db1a29ede4e9d9d503164e4474f113416962d78b19c9e6b991c59e5daa6c834f3000e91c2fdffc9ba967042e4baa80284fe538a20c427f61051d03e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e79b4a32cd623dd0e0be7113ca00a95

SHA1
e9aeecb929ffd05972e057a43b25dcc9efd99c7b

SHA256
3ce71ef8b74d3af6ffb63441e4cac8075160bd6299054ff69ae448797c21004b

SHA512
bcff9e95b7d0ada3088acd86760dc3c119c4b413e8e3306fe4f701f139a4483aab2228924ffa0cd2db39663910d3a520e5b09462f49c06ee15133c84e877cd48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cddfa4458ef95a4afd06e888f4a3a2ab

SHA1
6f3a1fd2cd8017f80c22c1125b369ac87aa47b5a

SHA256
9c6ccdbfc478649c4260c52b5f49067c9246c29b93cea85e42f010be18723870

SHA512
1778e924db3651453afff1a484e9087f51fba02472e104f31568bc543a07f4d6991063966c521764ca2963bca6c3c7039e9e247534f15dd22aac4745d57476f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b3bf.TMP

Filesize
1KB

MD5
63ae1b00bc05591e1319aa5c44f17adc

SHA1
64faa2ffdf815a04cd595a4456b993c63b93fada

SHA256
f034585f86b33b7490d66ab4e44e24235845d27ad5080878ea09b03df4ac3d90

SHA512
9112b7238979d5515086150e23e66de6a982950bfa6e3d0f6e14b87e12980deb3affeda9c3ead2e63ab4f2e90745cfd83ace5bc9f539651b8779125f431e4f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
de916e13362f09659f0371e4610d7dd2

SHA1
e0cda87cee29e5055fdad5ce8d11deb3c243d22f

SHA256
68a859bdb50c533e8479fdf090322f37fc2c1d69a794accd572900d3451a2250

SHA512
f51a49a1e2c055f0eb7d16876ec3f0a2ce7d649cc17a738ad210f1711d9e0e8c6f14ceef0d34693032375e67aafc0e5b11c676930593583353fda52a86c0653c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
02fd65695809998359503de3f47b1655

SHA1
f1e2ccd919e76ef1f2022f69b8968eef6da88c76

SHA256
cb031e00d80b9230d5e006adf6c0d287a02c5998d933668b2c6647ded08fb4fd

SHA512
ef94fbf2cc907bfcd067b7791f4b94a73773529a2373348ad8b4fb0791ee0ccfe615c9747f67779ae0b8dab449af3000029154085a17ff6e2eb6da4d06643c87

Download Submit