hxxps://03vpo[.]mjt[.]lu/lnk/AU8AADLNRU0AAAAEedYAAE6Qq9IAAAAATDUAAEJ_ABymkwBloXFwQ3U1n_uSRtuXZuFzEGZVfwAZ01o/1/28iz680OJfKCHkixH6Rgqg/aHR0cHM6Ly93d3cuc2V2ZW5yb29tcy5jb20vZXhwZXJpZW5jZXMvc2FsYW9jdWJhbnJlc3RhdXJhbnRhbmRiYXIvY2FybmF2YWwtZnJpZGF5cy1leHBlcmllbmNlLXRoZS12aWJyYW50LXNwaXJpdC1vZi1jdWJhLWF0LXNhbGFvLS05MTE4Nzk5ODcy

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
22/01/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://03vpo.mjt.lu/lnk/AU8AADLNRU0AAAAEedYAAE6Qq9IAAAAATDUAAEJ_ABymkwBloXFwQ3U1n_uSRtuXZuFzEGZVfwAZ01o/1/28iz680OJfKCHkixH6Rgqg/aHR0cHM6Ly93d3cuc2V2ZW5yb29tcy5jb20vZXhwZXJpZW5jZXMvc2FsYW9jdWJhbnJlc3RhdXJhbnRhbmRiYXIvY2FybmF2YWwtZnJpZGF5cy1leHBlcmllbmNlLXRoZS12aWJyYW50LXNwaXJpdC1vZi1jdWJhLWF0LXNhbGFvLS05MTE4Nzk5ODcy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe
1688	msedge.exe
1688	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
5004	msedge.exe
5004	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4824	1688	msedge.exe	77
PID 1688 wrote to memory of 4824	1688	msedge.exe	77
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 4708	1688	msedge.exe	78
PID 1688 wrote to memory of 1888	1688	msedge.exe	79
PID 1688 wrote to memory of 1888	1688	msedge.exe	79
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80
PID 1688 wrote to memory of 3756	1688	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://03vpo.mjt.lu/lnk/AU8AADLNRU0AAAAEedYAAE6Qq9IAAAAATDUAAEJ_ABymkwBloXFwQ3U1n_uSRtuXZuFzEGZVfwAZ01o/1/28iz680OJfKCHkixH6Rgqg/aHR0cHM6Ly93d3cuc2V2ZW5yb29tcy5jb20vZXhwZXJpZW5jZXMvc2FsYW9jdWJhbnJlc3RhdXJhbnRhbmRiYXIvY2FybmF2YWwtZnJpZGF5cy1leHBlcmllbmNlLXRoZS12aWJyYW50LXNwaXJpdC1vZi1jdWJhLWF0LXNhbGFvLS05MTE4Nzk5ODcy
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1e8e3cb8,0x7ffe1e8e3cc8,0x7ffe1e8e3cd8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14718673062767016218,2039292126575829473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bb88128b6b2d63f04c36ce68ed52d0a1

SHA1
29cd0515976a9249fc96a9d77c9986238cd1c2da

SHA256
19341f9fde32349d43cf9951f118ebbff856499e0e6875101eaf2db37a7d7d8b

SHA512
ab3071e116a32fc105a868fe9f3cd11cb282fc6cdc1e101b09c7f6269502f98b34b2f0a2ec32eb2b537073e2b20bd22cefd2fdcd4be87f8b169e6eed3bed1ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
884037db278c2612190b1b18b27e1fc4

SHA1
50b28c9623e8b9e5c4f80412850ae255c28fd228

SHA256
f2501a85f2011778a266393622f4064fd14562ccc567c8564c4bb82109dfc98c

SHA512
a99429cfaca0d342f4153d90eadbdb879feff9efb999d54ee37fcc2ed588347348b346e1da2d9d491c796aae431db0d52a68581d761a3ff3896e154742ff1d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
08154ba903a091cd29958b05af6c5a3e

SHA1
794a3fada9c59f2b5fb54fab54ab153728d0908c

SHA256
6c94f8da296cbb58b080f9d3d11297739a24cc4bdbb7c7288bd18fe19883cc0e

SHA512
ba29f5d2f72d2f82351ea1707ad1bbda41bd2d457027f57e0b4a6f486c9b72fd66dccf4d1a234add6ca760e4f3e6273f0c52c0f3d4e61e34be2ecf434be2a22c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bff071d39e2ea9fc655801c813e1ab34

SHA1
c1e77166ef5d9d19bb07e19c9ee2232972fe6be9

SHA256
045cafba1ae93044ade6cff72c2a933a29e8a786ba7ef84b7c9ce0c20a65ac40

SHA512
6a16092650d6dc5bad1d1a3ae88a69629cdf40574f10e1ee6faddd2008c23cdaae6c6facd27660e982a04de56a5245bc86143b8e05c9ab52a8e7746e1eace083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
1f61f255125ff2cf76447ee141a818a9

SHA1
212d6014a334f0c718edbb619b5eb2546e595601

SHA256
d69a7acbc0bb3e4a73b5fe9019d1732075fde5d21f7f547a68bd928b9742b7b1

SHA512
68f494b5077525cef2e6cbb47cb47eee8461a75f81e0feb8653e82ea889727370a67d44e9e7a1b12211a8edcc0bf239cdd8e80b1a65315623f358d56df8010e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a129798da54b4ed4ef5acb9fbe15607f

SHA1
e67938138daebde0ec917f67fcd6213187d9b91f

SHA256
1daf0819c45e8f5deef9a47ab51e404e8975696fbcaf4004b62562730f01a18d

SHA512
137c17e5f88a5997c26edb6cf5d1e7f2a86e73df6afcc4806a5406e28bdf55c2f4d5ec2b61c8894bfc9106c9aadd6f8467f8822bcc56f32c952f68188d028af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
87796f83a580ad1059639b7b6f48c978

SHA1
3aeb3452c1d42aa82dcc46fac0eff546266958ca

SHA256
ca9281ab005e47fe20e132b81ccfbf7a5f0e6d845cd3412129bcb07cacb1397d

SHA512
196d07ff37bf35b583ba80ef92e0277eee328925a77accb3dae1ca10a356a7924f49a7e6233db1b8b320eef6beeb9677ee7d642dd4bcdb2f1343cfe84fb186cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1283344-2fd1-46b6-9cb6-113d27871deb.tmp

Filesize
10KB

MD5
35c9cb14a6322b2c25a41d7dc11c72b9

SHA1
3d0d72a0dd0d522bfa27a4243bbda386a270eb85

SHA256
8651e96e2dca949e3359f2246b1e3a0cd4637c6ef45d8d8b33b41d12228f3cd1

SHA512
539dcf79c81f4c6ef2d6a256ad8081b2f9c3143bfd95da63f6f9baa219e6f0efd04863fecfbf4b551e9fae30309302f247c5f520956405214e9cd2cfd6cdeb5f

Download Submit