hxxps://bit[.]ly/3UPGkBZ

Analysis

max time kernel
121s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/3UPGkBZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
4812	msedge.exe
4812	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 540	4812	msedge.exe	57
PID 4812 wrote to memory of 540	4812	msedge.exe	57
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 2204	4812	msedge.exe	85
PID 4812 wrote to memory of 1880	4812	msedge.exe	84
PID 4812 wrote to memory of 1880	4812	msedge.exe	84
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86
PID 4812 wrote to memory of 1548	4812	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bit.ly/3UPGkBZ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2add46f8,0x7ffe2add4708,0x7ffe2add4718
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5064560685173063746,1158937320812638060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
194KB

MD5
ac84f1282f8542dee07f8a1af421f2a7

SHA1
261885284826281a99ff982428a765be30de9029

SHA256
193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

SHA512
9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e75539b9651fece0e206fa1710b2c5e9

SHA1
ff1484319448d711a1205e1fad3e0df00133fea0

SHA256
d42c135221356fe89342d959f031da1deac499d6a38305fa1671af4ce61f0993

SHA512
e7398af5ac642605216fe15d7ef2dd943ed52fbf35a2f432d406358ee960c80e17005527631afc7c98a433943e9069ee554a383e3c648e15eb29d9ba63ce2f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ee543eb4fda67d966b7517d6a1d1ef04

SHA1
546889bb82aa0cbfe58c3abb7ef19317512a537d

SHA256
b24ec3dad6d69072299b6a514404c6aba450ddd1d78c6e7468048d5dbc4f5ddc

SHA512
ebc46171daf5a0d5cbbb36c9b95495f82c952e2a5c12f00e7c5cf7fb6325eeb4efbb000f594e3880c70f4ff9ae907284bcb3de5e337bdbd164a0cec3e0b3ec1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
b21cafbbdc35f897ed26caa86d3b7f10

SHA1
1059fdb44b43d6283fa64b2de68c5ce4177a26c6

SHA256
ce3be312ab7b4423213a2e78c13c725c693ca5b97462618b362000e688a0328c

SHA512
99029fc18065056639a2abb32c373fe9b658434a39465fc189dd5925276a2ff8751580aecafba6f519b8617f5e5127bc6e5b383a0ff43e22f0d55a4106b1c511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8862258b0351a242aaee7cd5a7ec2c6b

SHA1
3824446312cf3a17627dce75c37f9af75d493ab6

SHA256
45b2b47fac7513bb2f67e8db75bfa56c10dd0c6f4567ad313faae9475c9e1342

SHA512
302393c11c1a91ddd2bd37a93157fb14f114613ec1c84a2312725ad82f5008fb043f259295b255c697c454416bb33f20770d4410e672ab573613917dc22a319c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a96c03b7210b3841ac6fca5b669bdc01

SHA1
10091398208719a723fc7599c9e3e6f7d327e76c

SHA256
7e63a92dcf6896df9d6a2640260ae265922140da61bc79084193cc70871e3775

SHA512
067f03861b9f79e7cd73ff81d6f4b3ef83884ccda523c95ed6f401794bb5f08d57dd808a1168763a99f5f9e5cc5ab39562c62438137a4d700263a860099d2f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25c62e3b7d5ee02985fa104480d57589

SHA1
e8c739c1b1b4314a447ba39bd8d03c9b6b4e2d8f

SHA256
96732859b9c3b8bb205f48f0d179a980aa4f6f428974716b73573ffb363da0b3

SHA512
6555129bdd04b4a585d33c4def5206919204425cddd6e53c9f7015e56e64060a33897e9fb361f1a59cb0587d145c6c3b79116ed1601dd28fac17c30ab0596cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36e72db92dcace208255e46847dc726f

SHA1
756166407b4f0c8621c8f06d4e471dbff8f72054

SHA256
7da58cd84110a9220fc9f1e09a4984213e8a02c0a9220f4e9e5353d1e5367b2a

SHA512
19598addfbac674f73acdaa46cf579dc172ae32ec9391b9f1a415c7039f6b266ff65b98f0082cb667c09667ea16b17af38ff6b399896c7a7d0ccc2a1fafed1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be535e9569721f1153180ba45cd48eac

SHA1
76860ddbbd49b1fdbd3d5bd350d23b0129e34d15

SHA256
fdc8f1838547fe4518fa394ead12f07964fc1da66f7ccba2129685cd98ea1192

SHA512
0c8f9d6ea5f8c6b178db8af2b0dae4de10b76926f289b819227b01c4a534974b5db25abf0be123303efdca54e65044d569a44c150b304a67e70ba92523fda5aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8594bf2acef10827d9630b595f7a2f5

SHA1
9edfb8d06a000bda651369429fc872116288c6dd

SHA256
df2f39ce3e4e2fc4d38ee6911b8e02932b269719db412d50147711316d7dd379

SHA512
b4033d6d4982f3e10dfdae8684d50892c039743f4c28dcda9954f058b7e9fc0bdec94468ae40ae23c1f146aa050e8f384c3a3cb60c1db04cd7b95594d4ce1ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f44c707fc5a022dae5a26eb8457fd5ab

SHA1
dc04bbe7e6e3aa4e97da317d94955ca62a6f1b2f

SHA256
50ea8e4a2160514546ce615064d0a81a10ec53007690e7cbb8982a856f73d73a

SHA512
5615d9a915b97e0e7c7bfa81ec2ef1c6d7ff9e55560cfe922a5581ed416787bc27170b25dc1807c3d2fac341854090542d01cee2d4436d6a9fafa4ac20008efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f674858e9f696dce1b5f53763eef1205

SHA1
2958910c2fcfe5c9c55efa85ce3b964f621ce2cb

SHA256
311adb61af84acfc94aa176c5b37c615758f9b7acce684c1b5403c7ee5aa7372

SHA512
eda1b5fdb0f89922000de1d9e30186a9eaef6c081d155e981ac736dcf1594402c6daaa205c9e0956d9c37c46eb328f373a2d4adbe3ec41576c711a4e56d67294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b8c7b239a3d1daefcc14f820e34b2c06

SHA1
c3dc44e47953140d907e9dbb45a8f08645c847b1

SHA256
1eeafb3beef7f2352a4e185a069c13247f058399cf05eb921411cf7375526f3f

SHA512
c4730031a5f15f772bd2f5222597130f220dce9a80ff55eb3ba78e85159c9ddf0600ea5849329d84196a5a1ad37e7d635ed573ad26e3769bdc925de3d2992d53

Download Submit