hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001EZpgOm6BBWLOSzaUpjEpj7pKTXvFuLi419V1wPUu-h8LmUypza5lgWI390GTg6F4cIxuQ9Ol6gruXuWmeA5eesgPMCrWpSrWmXkyPmiGqOPtQvHgPfnHfXo_Gqj1r-7dZ6S-GnoghBE=&c=&ch==&__=wp/acme-challenge/yjfyjjffdddtd/gghjhfggd/#bW9uYS5kZWxlb25AcGhseS5jb20=

Resubmissions

06/03/2024, 19:11

240306-xwczmafg29 8

06/03/2024, 19:08

240306-xtfbzagf7v 8

06/03/2024, 19:03

240306-xqb55sff49 8

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net/tn.jsp?f=001EZpgOm6BBWLOSzaUpjEpj7pKTXvFuLi419V1wPUu-h8LmUypza5lgWI390GTg6F4cIxuQ9Ol6gruXuWmeA5eesgPMCrWpSrWmXkyPmiGqOPtQvHgPfnHfXo_Gqj1r-7dZ6S-GnoghBE=&c=&ch==&__=wp/acme-challenge/yjfyjjffdddtd/gghjhfggd/#bW9uYS5kZWxlb25AcGhseS5jb20=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1792	msedge.exe
1792	msedge.exe
4164	identity_helper.exe
4164	identity_helper.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1536	1792	msedge.exe	88
PID 1792 wrote to memory of 1536	1792	msedge.exe	88
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 4864	1792	msedge.exe	89
PID 1792 wrote to memory of 1708	1792	msedge.exe	90
PID 1792 wrote to memory of 1708	1792	msedge.exe	90
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91
PID 1792 wrote to memory of 2224	1792	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://r20.rs6.net/tn.jsp?f=001EZpgOm6BBWLOSzaUpjEpj7pKTXvFuLi419V1wPUu-h8LmUypza5lgWI390GTg6F4cIxuQ9Ol6gruXuWmeA5eesgPMCrWpSrWmXkyPmiGqOPtQvHgPfnHfXo_Gqj1r-7dZ6S-GnoghBE=&c=&ch==&__=wp/acme-challenge/yjfyjjffdddtd/gghjhfggd/#bW9uYS5kZWxlb25AcGhseS5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff9fef846f8,0x7ff9fef84708,0x7ff9fef84718
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13383601226570449086,17205330100480604923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
42d3689ea8aad3c4493f55c0a115b506

SHA1
49f08bc84ccc1893c61eacc1bfac0caee50739f3

SHA256
c04e90f7f97358e0f52b8e838eeecd4e9f241483ebada4620a5d98d0b726dcb5

SHA512
6934cee2486dc3a81164dfefa377ed4316982e7ecd8a046f078576a550babc59a7ef176b4dab475f3993b321ecfc8f4f5d60eec8cfebf7d3025d4e9334a01541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
477B

MD5
a937c0cf00e877ef0228f677b5b7028c

SHA1
3181fc03f289467a9936b9f823b1e18e3d33bde6

SHA256
f88ad2d8740d18ba27a94bc7f5dc9d60ed194a302da9193c226912868d9452e4

SHA512
7cfd293bd409cc1b1ba2c143c212d5b5bbb0280c8a5bedf57fbbd7eb91fcc336888c16df7e7f4f715f83f0448203f5c36d3fd9a50bb38929d36757f8e3dc0836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dedbda35a6e69c1f21af0904c7c3b187

SHA1
baefd159ab675e093bcd85df7c4e2210257a9f9d

SHA256
b68aa1882aebdfd4c38f6dfc6299ce9c634117b08c27adef6c55b1b3dbf4957b

SHA512
ffb70545211adced0cd9bfc7c96dbb94c54a1f35e359fee9e7d43e5ddb29f0ac29fbf5d3084e092cf18b9564cbb8b93c6b090ceb98e1a9c563d88730248afa6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62cdb5c0db540005534335cad25ef729

SHA1
a3db6e295fed16aefa91750b869457b420f8bd62

SHA256
eb53dafb4b9e77c726e32dbfa67beb430a8d853f7eb8be55a0a630796b54192a

SHA512
8c27f5ad0da61c8b132fe91ce51f8b72635fb65564431cf73cd7bc7e3f50beb626e5845b3d0d291af3ad1508f2ce578a016e0bd31b9e4c91478161b80548390b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fcb831ea792de4b0f0e5386683ae071

SHA1
bceb424a1fa040cfad1e8d3ecd75c8516eaf5603

SHA256
f37fdfd67b032a6b80d3e9b03c058b7763fc1347028332d8f5f65cb5c7d14977

SHA512
ea581a99395f0fb621c3a1c427f2fc570b25b7ea9cc84565a449ee7dbb3f0158e79ae74412fa2792aee940ada119bb87a7e215b37048ccba285b016117f38a39

Download Submit