hxxp://myggov[.]website/AU/MyGov

Analysis

max time kernel
238s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://myggov.website/AU/MyGov

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
100	msedge.exe
100	msedge.exe
1120	identity_helper.exe
1120	identity_helper.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe
100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 220	100	msedge.exe	84
PID 100 wrote to memory of 220	100	msedge.exe	84
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 416	100	msedge.exe	85
PID 100 wrote to memory of 736	100	msedge.exe	86
PID 100 wrote to memory of 736	100	msedge.exe	86
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87
PID 100 wrote to memory of 4516	100	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://myggov.website/AU/MyGov
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff09f646f8,0x7fff09f64708,0x7fff09f64718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2432 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,248283108825231879,10391041163272754926,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\cdeceefd-4f23-42f8-bc10-a9243913ccc7.dmp

Filesize
6.4MB

MD5
0fc50ef1da84a260cee72bf1d775ba9a

SHA1
571a8397ea193377c3965e7691a910d2fc3f16a1

SHA256
1f23ad4a4129dd12227e87f6e2ae8c1049c74d8d63480df1bbdb7b47507c78d1

SHA512
79e85784e718ddfb1f6acfe1f728d5ac7acd04df23e3c9e4c24cd18ffe8aa8be6bbed207570582f08e23eca3cb13f18baa90f0007b9c7023f6dd5be90108a8fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
05e8f07ac11e201d250aa053680ccfdb

SHA1
77c26569e10f1e09b41f6163e0d9b3f536f3feee

SHA256
39a971f223f2358cef6b47f8c2fe4a5eebfeb07ff993c69ddebda547e231bce9

SHA512
16f4366c2583138b45561c072ab1b71be80fcb09080ba190d5a10c115af8a55aee1ea9bdf3df6513b6fa2beaba0bdb971a2d951c50ae117cce9b5c1227eceecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
555B

MD5
19cca42620fecdfc79566fea388b865d

SHA1
46250c5c1d7795b75fef80b383df1f9760fc9d38

SHA256
5acdec0f72b560cfd956459082354c07b6464770c987c1d467303dab8f7a4e8f

SHA512
6b7e2176d0f48b643d2d49a4f115e49fa1399044a122724fdbae82adf21b8adebdfba2e52033251d29c82476ff46f89d4806f4f3af63d60591041607710afb91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7866b7fcdc30184f6510348cc8dc48e

SHA1
5af7cfd3df467a284f3c99c2a25bc502266dd446

SHA256
d8aa40fe658ed66e485f0e58f02c4daa9d254b872e729fcac25a1fd4e98f47e4

SHA512
1c21e67378be88cb8e697d6ce8296c22ff385683b2884d6b8ac224e7c53df4c7d25e9b06cb5695050a3386b59451595d4c12c5c0bac529737973718e627e49d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87a9b90c47f273df999ddb8996b023d8

SHA1
bed41a039cc11fd952f4db1a3a8bbbcf065273d7

SHA256
3da7cc7f90a865b927d1670b5f75ae391ae85e9ff5a6e77f3e2e57aae52e58e4

SHA512
96d14f56a16ba8101859394f17b5002e88d8a5bc3470b269f0cbcde07ee39a97d37c406367ad477c946300143b0ba121eae5a6b3a0e537f3742f4d2d0c24b5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69c68928e44f0fc8499e47507b2e59eb

SHA1
947fa35870b5abdc8e75d8545ff7a8239bbefcee

SHA256
3764b8ea630ed549fd06f25e5be4597bfa05a2b05b09d47ef40b964ba2533e29

SHA512
970b5f921df656ec8478ec43637504323a26ca69b711d4d2c5e91c09a2bc9f871e02e64b1729b5e33300eff08c69e5e1b69453107d7c0adfd808b04a63c3033d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ca4de9eaa6880b2944541457df94003e

SHA1
bc59171b97a874be5707bb59cb1376eeb4815cd8

SHA256
ed93e8715ec101233d9d61e08a02b5b1ec06ecf1ff9ff62fddeb08cf91cb2503

SHA512
22dfb7c2c2eaad6f9af2710efc6f5e5fc453dfa32f9249f7c34564ea1c774da4ea7ed3de07ce1eb96e4d61e3076528b71f99b6d738cf676dd04e0efc876bddc4

Download Submit