hxxp://url3963[.]my-media[.]com[.]au

Resubmissions

22/02/2024, 03:53

240222-efybhsbh95 1

22/02/2024, 03:47

240222-eckk9abh69 1

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://url3963.my-media.com.au

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2200	msedge.exe
2200	msedge.exe
4316	identity_helper.exe
4316	identity_helper.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2988	2200	msedge.exe	84
PID 2200 wrote to memory of 2988	2200	msedge.exe	84
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2180	2200	msedge.exe	87
PID 2200 wrote to memory of 2244	2200	msedge.exe	86
PID 2200 wrote to memory of 2244	2200	msedge.exe	86
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88
PID 2200 wrote to memory of 2308	2200	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url3963.my-media.com.au
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf09246f8,0x7ffdf0924708,0x7ffdf0924718
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10740302480346446057,18072941757238649377,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
113KB

MD5
d85c69461f0c66b39df16a19770bf4be

SHA1
9d3f70286218faae200e8d7cd33bb7ac5bcb8f75

SHA256
acc8a981478f4464335db25aabdac099d28cd8068f263e1a3ca18796976dcf67

SHA512
f9be99646646c77edd65fca67517fb1fba81121b0a048e543b3f102a72be90da8dcb86e38d9cfa91e0413b04a04163c0b25e8ad8361fefb9c69eac47b78f87b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
612544c6558f7d8906beeb844dbc82c4

SHA1
db13b9e82f3e770ffb1cceca3850d322ff982689

SHA256
a9f79e434b42ca7b1c748c37b6be6e7cecfd6db68ffea9fd32196eb8cc94a1cb

SHA512
080dd7586584fc462a83e53de354b5ed906628b4a728953af9098666963e75a595baddff8ea25186d54216461504d15c85f07a1539b2c3c4eb7ad541508f7aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
d0ddf7303e55051efa5029075962101b

SHA1
51675367a09ec886c50056c76348f2adb65cd37d

SHA256
61667e596dd7ba111844397ca45d584956aeade8e01a7b3d06599ef632deeaae

SHA512
fde8f44f66d5863f10b43ae0b3b7b901a2dc7996723bf39bae20675cbed4586db5afb8bdbe01acf7b8195aab2c885923574a1bf0aeaed0351b4c68ef6f9eab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
84a2536f0a336f44d70ce1af084b211d

SHA1
ca8b9c777aa371f215d4dd0201ed38d0cb30495f

SHA256
53953b6d70d427c04bfc116b22f3011fc3d80d00e17dd7b306cadcb972a9421e

SHA512
ae2ac1899650846a75b4034a46291f16c391c2f0d1227f9e9ea2706b6d78d268dc214c40ef5b3adb31231fbe2c7e762b19e3f68ba6de1a68dabd21a48edc39b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a953ebb441b4c445dbdf20a1c855f2f7

SHA1
07674d65bd59c6a55b8b9cde22634fcaa55ac8fe

SHA256
a0e4d5ff10b6e390a7ae055c95d5b471871819b5436e78d677a8be16abdb06c6

SHA512
b3dd73eb81ab272d8f122a9905b558d9eb58561f09005f6317b579e5e468db704e842bf7ee129d56c6b4a5c83f957921415cf186e513d6ec2dfa654d32520728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7317802686daf14fa4856eb5cd2e81d1

SHA1
d7a577b75132463e391e39cb1d34f5b6cbe608d8

SHA256
7afcc7c024a8840056de320498ea1e127a4bce7116368419d6afcf487e29348b

SHA512
0ebdba479efb86ea7c2b502d89c820e3d69c03bd04e33076104c2df4fdab65e5ee58dee24cf686342c512aeee88a1fc915ee6cd6e66e103983ac6650321e481b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72d51069b5560db57460f9ff325253ec

SHA1
0318dd474c6d607438930a9f06e316100d210380

SHA256
caca25c75a1fd3e4a0b7c7bbcf0df568ac0efdda16e8edaad47051c7598c310d

SHA512
0532c119ceba9d513374f9b1fce251f651d14e8121c9b4ea2a0c637faa86fa1f486a3ffc66a89aff471484b05506a14f5ed300c64470a532d56d7bdbd32b90f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b01eb435251964025447c8d18b44e45

SHA1
3df4678f424b13da226a467379c067c91f316902

SHA256
924b6efcdf16ac7fc7859797ca09e38c00ace3489293a479bf0b38f0b15f632e

SHA512
d1ac29883fed4c7e100ebd9fd6af9bc97e8b0147bf24c15bf4994d1f3caa799626ac42e65ff1f320ac5b624952869460ab358526837dc70b0f6d4e4cd5d47b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ee368eec492cc1ef26758f829de726c5

SHA1
7034c61fd05f015d16b046511eb5c319e6c68f52

SHA256
e6c1443608c0cc412ef2fe71aa377eb9487e67752909f86b9a681806484d59cc

SHA512
aa197257ead88cfc625fa29c6789ced6a78e058e8dc086a551177122623cfb7f0de8dae7d2df0e7c21f69da9d24bf6945e1e61021c71cb5cf527ed7f2d3f0dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
09563b375774fc101cbda5ef1a0dfbef

SHA1
18b8a78b1ea47417aa5ef5e027ed1ef7d6e7389a

SHA256
c00f74dde4099c5e7a7aea272048f7151287f44de039c8ec76ea89398acefedb

SHA512
13e059d8f0d3ef8c08ba597a4832df274b030c138dd889831b9b5224403f050cd0b2d19fefc7c9c7287eb2ef9c9ea4d8b7bd6cee81a767195339e121034f388d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8f6.TMP

Filesize
703B

MD5
f5b346e3d27d62b2d20d04f2809101f1

SHA1
85bbb4668082f6426e2333c1feff470e15db9e62

SHA256
de97b6e0fd64b2d0c46a6d567551b268c41aa18d3c7aa004d390d551173d5319

SHA512
6981db549d9ebc81c5536d040b0e1b383e37c51b02c2e6af3a701e5a13096e2c4f3123228cc4761e19e22333a5da41b14e46e0a0d72ae9dcf7a68348c1143c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
458c81beb8bacabde935f0adc439e81a

SHA1
1ae11fdd63ab8cd9c5453a62dbdb2565ac1cc15a

SHA256
871b6dd889f723f19395e8702b0e030d0030c8a7ed7bd8fcbebd22879d571926

SHA512
97dc51499334c6fb521841b92f1b8ad27ad460a8bec9dfec2f6b8679686ea556ce6dcbebbffdbc77974a74756cb0f86980e44fea709780b6270c91438540e4d9

Download Submit