hxxps://ics-kyc-helpdesk[.]com/nl/3/19297-00284/

Analysis

max time kernel
296s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ics-kyc-helpdesk.com/nl/3/19297-00284/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
4108	msedge.exe
4108	msedge.exe
2588	identity_helper.exe
2588	identity_helper.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3492	4108	msedge.exe	31
PID 4108 wrote to memory of 3492	4108	msedge.exe	31
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 4716	4108	msedge.exe	87
PID 4108 wrote to memory of 3776	4108	msedge.exe	85
PID 4108 wrote to memory of 3776	4108	msedge.exe	85
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86
PID 4108 wrote to memory of 5060	4108	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ics-kyc-helpdesk.com/nl/3/19297-00284/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff839aa46f8,0x7ff839aa4708,0x7ff839aa4718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1796668076073595481,834837863822469787,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3528 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
95bb5f7e42217c4f0bf82a6f599fd1c5

SHA1
301c3cbc5ad685f12d8fd6afda75f5541fd76d97

SHA256
130181340830a7c0f340dfae58f6bf571e1dd65dc2280459fe7b0837fac30dbb

SHA512
b377d59e0a1523fcd37f13520e77df5ced6a067525ad626c2edae0f4fa8cdfcf78a357eda5849a1e9b60e618b7ccf397f64af924344e797155683023ffef90a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fa070c9c9ab8d902ee4f3342d217275f

SHA1
ac69818312a7eba53586295c5b04eefeb5c73903

SHA256
245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7

SHA512
df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
273e38a0e3a862dd5ea7c0bffb0d727c

SHA1
f6621bed31ae8a9cc4e7feca17a0bf4e6e83196e

SHA256
95a55c7caa5e2429dc13e8c1031584b4b8c1951965d99c75629466ce51c88f73

SHA512
d1991f3918d0e1dd903688a6490e69b71341ed145f6a216c43d41a145190289eef3a22e05b9ca691e966da039284847b758c3f2e689a303b1d43472c82197954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8fd4a4697706f44d7d7bcd608848ad89

SHA1
e4fa79ce612c32cbf2bd198afb8722f2971f8b75

SHA256
c478daecae076d4faea3b07fbba2c72dbecef194c648a12604f36b352bb5198f

SHA512
938c0e0e68015e010971e0bd170118621414e61b451c77818840baa628872f924089396425dee7b4e063927ff6e20dbf911cc17d4bbf40b943d8b556e1ce6ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
561B

MD5
f0c96b234b02852a07d4df9c3002e25a

SHA1
7ea68d51b546d06e7d6417cbf661472d4b85e27b

SHA256
4ac96eccb2a632227c8561064672360d44b639af6a49f0ddeceb0ba75290a3c5

SHA512
8b41fabeaa8053b7225aa4a76a4e7e15028a52a5de87e26fbfa46e7845249b3f070e1e1c9e55da314a6063ae830229236060fc0cb44ceef6330197ebdfff2487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
561B

MD5
6e9952dac04c606a6d8e0d16eca810ea

SHA1
5cb1d6934889fce2166029a6757320c31c44cd99

SHA256
6d346c7cf63599c4b552113ae04e437ca193e0ec2d49987684d01278d4b7acbf

SHA512
cadd8b5b3b0c3eeb09bd39ae62fa30ae50085bc1422720b4a8eba920add7463d9593ec565aab0bd795a99adbd5376ff4e10db108a1db02a5f5be5e44baf5c92a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63db46ec6d6d3c7833554567abb9a950

SHA1
1a58844c9c40235bfc05876c89640d7792483266

SHA256
4d33f8c2d9eba419317fb474b57c2beae47682db2ad86b395078936e3767c3fc

SHA512
917b9fb67b5a2a38e6b2b99a71bc65471326df43094d860bcd0a82d896c6e2a0b8cb13f7e41f1099da0f44f5322d94845dc0f014b2e8d8f97638832346664c27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfbfe7c16f5122fb4bb0c7f4437b6370

SHA1
3f2b5f5fa421dd55630114f43d3818de99f8e5d2

SHA256
fa200d3a2ef881fc66f3ba64d290790a3ea7a8f1b5e6a9d2f5aa0757342c973a

SHA512
f54debef62543956cd050cfcad1eb0fd2dcf257e22907577bdcce54d36b8ba0f1a119c6ccbdb9d3f37035fb4d782fe7e8c42a9ace27334b9c4ee4a23f558654d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5cf11bf9c0099905ae1cecb4c5af4662

SHA1
7ba6a401cd20d7c1c229d4e9353f33ce54302518

SHA256
3febdaf1525954dce9189952d39d323b2f9ba3d856a8cdf3a8ab645318de0b59

SHA512
3985e64e1f3f7bcebfcd8f7dd93289cf22f76047a9bd152fcd72f5a1f2b33d89a827789fe975309fa190dbcb0a37d911b87e9e1ba8585aad6535f0023d795140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
903218b3180408519781d5d6d75c4125

SHA1
fe03e4399b84cd8049e7744b4cb58221f7c9141a

SHA256
aa75a1254d7480abf3d7eaa43eefa4e99087704f10009578c039a7aa2ae4c4c6

SHA512
3328b5b70846387e10794604357ceec11d70b4b790ea92f1e83a7a3caf13c5836b7b7965d7bfaab79c7979cbadefb21cdab5a56db6172ecaa4b6c4f9ea730c20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
917dedf44ae3675e549e7b7ffc2c8ccd

SHA1
b7604eb16f0366e698943afbcf0c070d197271c0

SHA256
9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37

SHA512
9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d62be361ed1650cf31ed21a0d2351d2b

SHA1
6335f5aa9232e70a58a0333a7337c6c56d5f8ec0

SHA256
666551678710683dcc2a29edbf10c243d44323a4aff4ecc46a12f814f80fbc6d

SHA512
8db970aee628d55b96d450403d5abac6fb71e5faa7ffbee775c697fb5704ca956d1a24389b8d08b0acb4d31b992abdb11cca7f04eb0e4ae871a859088d1dd21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
99d589e3da8f6c86eeb2baff9726b1c6

SHA1
8e29f8fb0fe5e2e5a6b757422154980a572ee715

SHA256
709dce5200190d9bc59c6f9ac6de58deff0cfa450b51e1e0c8a9ecc0d310ad36

SHA512
b94cb805bc793047cb8d4f90ebcb07f8efb4a29f184e1ec68995d3ede7b8d4d26814bc90e8aeb844d130cdaa53057ac8640c17885ef258d5eaf21f86c83fbaa3

Download Submit