hxxps://revi[.]cc/docs/playbook/installstock

Analysis

max time kernel
150s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
13/03/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://revi.cc/docs/playbook/installstock

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	discord.com
24	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-160263616-143223877-1356318919-1000\{D63BD845-9E44-4F23-AC98-0142B36464F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
852	msedge.exe
852	msedge.exe
5072	msedge.exe
5072	msedge.exe
3164	identity_helper.exe
3164	identity_helper.exe
1980	msedge.exe
1980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 400	852	msedge.exe	80
PID 852 wrote to memory of 400	852	msedge.exe	80
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 3588	852	msedge.exe	81
PID 852 wrote to memory of 4488	852	msedge.exe	82
PID 852 wrote to memory of 4488	852	msedge.exe	82
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83
PID 852 wrote to memory of 2828	852	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://revi.cc/docs/playbook/installstock
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeece83cb8,0x7ffeece83cc8,0x7ffeece83cd8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1992 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2008,6620004403819242333,14552503694206563772,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c48e8b68231fb5b2d7f1188b930bc0e

SHA1
1822aef5da8fdd47626fb91afcf79a2be175a325

SHA256
c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944

SHA512
2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2dc80f5403feb8461b7ffa09890d6a0

SHA1
d5b61e6d672e7e71571e0132e21cead181da8805

SHA256
eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a

SHA512
5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e0aa21a062873e2b7a0fb013d0bb6332

SHA1
540413fabca8b9e8b6a917d0fa3074c93fc51ea1

SHA256
b92654184a1bd4978bc1952588f1609a45aae8537422f671f9a8924a1702658f

SHA512
6964bad3ff1e32cfb1d1cbdb4e95f1475de6aa4637344186a3190a2db615425ae608169fc55aeb9590bfc7fe4827a8bfeab004fe1b3e3839ed361ca7a26d5208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
457B

MD5
929c724ae769be880e7d740e953ce98c

SHA1
cbc6232cad890f06e718128f73d103705bc66c2a

SHA256
2039f75c16f65193f4519a87c71fe1418fa32f2970c1680d4cce1587eefb4904

SHA512
a76bef7b315771978a3e19e9435bceb9ff30b31aab550a9520e70ff958d1fad28f09c7ae138d9529dfa339e676ccb21eff66f6a3b4ec00f44059b1cfbea9b6de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dcdbf0bc65c5f31789f9c89670bde71c

SHA1
8bbd020aee116a96dd5b5dd967d690ed27b8b753

SHA256
72b133092e7b2289fad708a80a0945707c361514a0e949165511b2e815b69782

SHA512
273002bf3c93e27f127ffd8f7938711839b1677632ce1eb71b2a73507aea71377e3331878a4186e313a0acdb95036c8a62b61cf417b641b06996d7f8a035b800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7244ab09941193d06603ce1b838186d6

SHA1
03bd9958bf0cd6af598a1cf306f3b3822d696413

SHA256
520d276e6de9c58ce67a633fd09deb222699011bce5c1485e31a35fb45a2f060

SHA512
8c6b037e2002b307436ace628d7ff395407a6892da5ccf33c0879e324077f39a0f78b21c56d700684a2857424a6f3079e381a5ef73e69ae6206056975d2a0f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9db5215c7fb81121884885b4ee786fc4

SHA1
17a7a46f028534e2c86d25ae311573ab8f358661

SHA256
e95c72af6e84332d63549879d2f9031869de78967b723e47572c3d71f0b427d5

SHA512
2a4562471af63bcb33c41c855c7b6fdbac8c00ec9f42f0e3bd8d8107820e20291a7a425fce67d3d9c4468e4fac35d71ba19ac7755d927d4fdc6dc5dcae55926e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
625e00a12d7bbaccb76078e06cc9eeae

SHA1
12d7c3d19c323516ebce06def194549a3bef167e

SHA256
deed600f7e15aa97299281fa9c590fab6bb735148e316472e3eb457aa4447735

SHA512
1a464fe51825bfdcc5697645cfa82f70a5df2cf3091065941dc3ab3af7b94dd28192830cb8a16ce0fe572aabd74023f8e1e299da13a0fb1c4e68d10324c05b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21d3db436eb8efd5adc3de56b7fd2a2f

SHA1
de5c175da25d2964e051feb07ad3066b4d4eb3b7

SHA256
3be852e36d7d208effcb24531cecc45a302095d15e84cd28a06bc572d17daa43

SHA512
0eb2f13ab9473fdec363fc4d8529049d9dcce89c5ee1e58e09cf73238e436d25e8fee431ef9c24f2440d9dd4dbd010659e9ffa6c1c8691deb64a6a01da492983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
c864ac048430ee8effe5fd66c849a8c5

SHA1
4e3ead349da7db78eb8d8ba1de18f35496b1c5f6

SHA256
70e9429bd3fce0efbddf22ecef73782744674d27bdd7b50e76be8deb37466270

SHA512
6d87cb25671435f39319cac7a2300f4ac731d810e857e955c38d981cb43b344f88c33ce9f66b35f0ae3d687692e4c972210387519be5fa2ad787082c82c9dad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
d9328600c190885e2a16c0a4c04c2f39

SHA1
8b391bc60ca109d04726c888a9cafde1370dd1c0

SHA256
9eb0366511038afa186ace2cbb6c8fefd11b16a5e52c987e38d18e0487afc800

SHA512
99b79ac458bc5d15c35251a715e0a9e220bba0397928e14da337be20022a31b0e432648f2338a7ff94e51623c837ef64bb4e17fb9ae01ea2ac8ed7c59a39caa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58172d.TMP

Filesize
370B

MD5
3f0a7919e50cbd6b7d4305f33befb291

SHA1
78b9c19dbe2763cf4232e0e55e4d87f60079d27e

SHA256
6ece794e0fc68962a47bf15c5a8629c9134212e640734dfc30399f073c2b95f6

SHA512
bd5cbc617af953d7da7aed4854d9f26da4f493772d2d821506b043e1ae6d58d9c6a967cbb869db0c4f5c4fc1b6cd2321889d96e5f336af31e60112887826c06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b467a5ebc6045e41c4da3eff44b42a02

SHA1
df55e06798c43b441986f6caa39bad3639a66542

SHA256
5ac4dd0f178ce93bbbaa479d22819ce28d62d6ac0b2f16f6b4443d35eb7a76f1

SHA512
0256fc98154834db55b33464032453aea98f1a9a41d612176ad5bba60d493231bb31097822078f343f1ccc15c6129bedf5ad2d4fab5271592d5fb312af75a2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b78272a32085ec8b7bffec1cb19bd960

SHA1
25d0678ca40208c9c0fb208cbf743ff5eb953ef5

SHA256
a5ea10d87dc9bfd0ece1d5da61147c0b4abf61ed8a0711ecb9b939635bc04cdf

SHA512
8cc4133a732e9640c955497d6eaf8fab1e5a3e8fdc0a4c5dc962379c4434ca382999e416e669ffb720c3aa8eccf502832b78a375a87111ae794ef111c6b10fae

Download Submit