hxxps://therendongroups[.]com/

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://therendongroups.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
2864	msedge.exe
2864	msedge.exe
948	identity_helper.exe
948	identity_helper.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2740	2864	msedge.exe	87
PID 2864 wrote to memory of 2740	2864	msedge.exe	87
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 4032	2864	msedge.exe	88
PID 2864 wrote to memory of 644	2864	msedge.exe	89
PID 2864 wrote to memory of 644	2864	msedge.exe	89
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90
PID 2864 wrote to memory of 4604	2864	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://therendongroups.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912f746f8,0x7ff912f74708,0x7ff912f74718
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,11214941271682620033,16874790689270877212,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
8327b2384bb77e1ddac1a033ba47640c

SHA1
e1f997b92ee7b2b20c393bb7a219d20944bd3522

SHA256
5d37b3fc78eb3fe4018e43ff7a506923d7c7cf98a1740d41f7d5b39ce462829c

SHA512
af93676fd3bed518327b7fdc0824f0f082078fa3e11e7e4dcea871a58b591720770a5bacfe439856a0625cfbf50ad72b166e0203ce0f39adcdfff70c01aedd4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
cb856681754fee6e89ad384ec58732bd

SHA1
abd0a4f92371170372ac0b1685ad97f46e364234

SHA256
9b47ebed8e800ea7c448616996fb63a0672491ab37835dc51f87d4ba46454a66

SHA512
f47e8c89503483b62442c51653ca451d5db8956e7f97cdc0204b05577417d43d7cf18d7389830f6675e30df9b2e1d2529335e1200bc8c214ca8ba97711db56ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
caa9585312fa1c49094aa69b785435f7

SHA1
b0b5819d4da6647c24d2f9edfd5163a07a1c6471

SHA256
550793912dde74c060eec5645c5a0952c481791f5cbc5dec41d9a17d631eba06

SHA512
ab8252087fedabe7634dcde4dae2536c2d64c81910ac183bc48f249280ffdb34c12e7bf4957002b2582667e4342a9a9a0e55b176eef2ab92fa4096a351d28eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
469B

MD5
ef64cea867ed12adfed3e412075564ab

SHA1
0781798e910ddcc8f3c0682a9f2a6b651de4eca5

SHA256
ca0942d2238398ef681e9598b01ef816d097db8d8e5343b9c4e0d6ea57ba5cf1

SHA512
ad88f656e72dd36af73ca1b78406d84726223e0a9819bec62d82001171f6cc2d44bd12a3e081b002882c950b6835e1b110ab4420738aa62fa500fe26de90563a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
348B

MD5
3a4bdc739e7a82cb61987197dae1a1c6

SHA1
9be84557e5d6851c63b9f3f6ddcf1ed60d6d2cff

SHA256
1b34f2e0e7bd5209b08082447c702fdd57d2251e9aa857c7014351db7687807d

SHA512
2ae31569d3496cb6584633f7547af3c5235eb20e0ad773b1ebc6e89de32260b6150d330f6d0f4fd5bd564b017a97c09a45cfc334e52af19e6a983a3a26243706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af91dadbe4a5a6058becb4c385805bd9

SHA1
6dd42fed630e0c7679162b0d6ca8e13ebe69b281

SHA256
5c6045dfcdc20e4007038ef7393d8a5af61303dc36d93925964f0d321c8ea5ef

SHA512
d4739e8d55ac6340b877c6014ae201987ae044022f4df5df4cadf63c9f82de1a9f8dbff09ecce08989ca30877e9755fc8c82f72dd291b07dc69bee0ba648c72e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6617ccd4ef7a08b919a02733a9198c6

SHA1
a2b1851722868c30b71c7cd5577ca848fa30db04

SHA256
d148c8d26b90f78d6f08c19eb04ec08e596aa15f12279e0c42b768742f2b04f4

SHA512
ecaed895b2744e5b2ec97fd0908725aa360ab45341aca3f17680ba00899dcce32ad3ae9297d373fd0f9c6d28489ed48ec4b11d12956765eaba89d68f0f75379b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5560f92ede58c7309c731c6934f0453c

SHA1
bd03a44629750f0ac3a631e8c8991dd1f98a0bd9

SHA256
843a824a02825aff4e153f996fe14362fcd5e5b59fe508c10a27719dccd83d91

SHA512
db47147412d73757096926f2a444eb0f7fd1ca1302167daf91fd6b55618e96010b34d7d0f9487f18587c53073423557fa4bce27511fed180c661bc489b9ef7df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad48fe287beee699d7fe23c6dff87fc4

SHA1
762b36ef95ef4b100c6920f601dd00ffd4d7e588

SHA256
8a7beedaa345977f8e5fcd0119265ab7c078ff23f8b9919e16727fcacd8f678a

SHA512
827534727f9915cd5dae53fee947608eb7417e79f83194cd7e99fc75785842f91fcd7707c1c866ae228b13cb5c30b055c11f15b5746c9efefa4e16b225f98239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65eed726963bd6002b2c5c8233190569

SHA1
ff97c51e13a81827b4527a5caab98d9239f1a2de

SHA256
0c7d8e10327fd19af6a2c86c444953b046e5e3c1598b93aa53ea58d81801e380

SHA512
9e6075633aed0790a48cf2f248ec179a577169449441019bd0fbd524131a66efb11c720320fc1cb23827ea910c2914520229f56a7c5664ac43b21cb3634e4427

Download Submit