hxxps://www[.]mouser[.]ca/ProductDetail/Micro-Crystal/RV-3028-C7-32[.]768kHz-1ppm-TA-QA?qs=u16ybLDytRbtEIHDRVfMwQ%3D%3D

Analysis

max time kernel
284s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mouser.ca/ProductDetail/Micro-Crystal/RV-3028-C7-32.768kHz-1ppm-TA-QA?qs=u16ybLDytRbtEIHDRVfMwQ%3D%3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
928	msedge.exe
928	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2052	928	msedge.exe	83
PID 928 wrote to memory of 2052	928	msedge.exe	83
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 540	928	msedge.exe	84
PID 928 wrote to memory of 2824	928	msedge.exe	85
PID 928 wrote to memory of 2824	928	msedge.exe	85
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86
PID 928 wrote to memory of 1268	928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mouser.ca/ProductDetail/Micro-Crystal/RV-3028-C7-32.768kHz-1ppm-TA-QA?qs=u16ybLDytRbtEIHDRVfMwQ%3D%3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8d8646f8,0x7ffe8d864708,0x7ffe8d864718
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,11243580170168286989,377020201148028193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AB1ABABF0945E38D11565C49B5119C1

Filesize
1KB

MD5
285ec909c4ab0d2d57f5086b225799aa

SHA1
d89e3bd43d5d909b47a18977aa9d5ce36cee184c

SHA256
68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b

SHA512
4cf305b95f94c7a9504c53c7f2dc8068e647a326d95976b7f4d80433b2284506fc5e3bb9a80a4e9a9889540bbf92908dd39ee4eb25f2566fe9ab37b4dc9a7c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AB1ABABF0945E38D11565C49B5119C1

Filesize
296B

MD5
cc4ae4e23c94b02532b68c9ec466d1dc

SHA1
ac5f9ba5582ce4ab50b0ab02afbfc6d8b68c68c4

SHA256
8f4b557658f46c94a667feb29f2c5df460334fe6a10486acc352e7f845bef28b

SHA512
aaf1404fdca128dd0defa7777ce8f0c27bd8c119a8d69a6788e87e5f06351c08d6dcb7ef3d0275f8252dad1e2b94b38ec2d6f84cc9c70efa2527d0f6eb7cff35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
4b24fee5fbea297bb387f3c77efaa05e

SHA1
29e8f3e98ca21912e111d5330eba02b8ffe67fa4

SHA256
887b90ef1f69295396ea877adb4587e23296b7ba8142485bf7d333fad53e8979

SHA512
2ecf383424bdc3d630f64b713bb448901125e2c4d1e9f2137971638928919aa5d7f06c134f2e5816d971eac2532db216def1fe78e386c84bcdb68fc9c290e389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
557dd7231b5d3870c985379f98010329

SHA1
72f64f40396559f5c2d6cfaecd60813679692758

SHA256
b5d0ec5d2458aa95c73e5490accda3efaae26d45280dc0ba2c61d19b0609b3ac

SHA512
849447396ee6a8e4698ae7ff25480de3d72bae55a283312d20ea578c0dd64862ac177c10eabf15af3bdd4f1b771525071bfeb5801f2facac6f56520592b1e12d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
946f828c43ed25304b6187703a8c3415

SHA1
cffe4271efe4daf3c78f06cce025de75f188ffc1

SHA256
8932dad8485069c2c9656a1102b08b188dc7d0fd6c8301927bed592476d7a60b

SHA512
655af4d8fc9b59b359918e1944ea489e017a948694dd1f34aeb26970385919f5a1b9292f2cb1d7f14094d82ef4f506bc1a4ad09859bfa1b9e4d8b746bc8dba0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c727b32faf24bf1cb4edc9f60573110

SHA1
387150a36bd2cd65e06349bb17db3dcf01381af3

SHA256
a120b6ae748396cf7eb02d64729bab47d3192f1f33cce5377d35389d165a0cd6

SHA512
50c53e90da01a95a3b3575c6badf9c112682f0bc1afd35f277b3c92fb3f45a1a56ae5a6bbe6170a54c7efdcd2208db95a50d070ec238f90edd33a31929166013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dab5819f407eb80b32bf89842e8298ac

SHA1
ef42d313605bbe48796ae56acecdb636eed9c6fa

SHA256
7cabe25f2e2f1939b3ea9c98846db4edf7af0a355b4762efacfc1319714041ce

SHA512
6aef9ff850128b731fbbf10321df6d6ed632e198c3b73049da0f3db64b8d7fb5ecd10d070396b1aefc91f5c1a1002d1af3db832fd02836aa5d0626cbcbe3f963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b3d78b7229bd80ea31ef7c0663ecf44

SHA1
dfef17cce54b2ff9419709883bb1c67ee82aad30

SHA256
5c01f9913e3457acb6fb33deb8b4ca43367e92aa2e39b12bc941b416a80850d8

SHA512
e6f874f912d4303a4b2b5ffc6befda96ce79bcd390f0a5b77a83517fbf58512e2085b62deac632919d8ac08eccc5bd00c828777e10d327493cc385718fbf46db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cb1a708c62f2e618f227811ca8d9eb2

SHA1
18daf169bb0f0eb4d6726db858c89f886c6c83de

SHA256
d48afc1df88699b6d83c655a4a5d1b0a907e22409bc4e5b43394451541130434

SHA512
63ec62290e112a68e8d05fb30c3d88bf7995b2d0ead3b2999215d7a14ca2fcd0ebddb721fd2b0f805fce6fa873ef134f869ae6ad4f7d1d1c587450b3b57e10d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f09c03e8b5d413698912e2299b22f72

SHA1
b2bee0ca5f85475ab7993f9642146c47a5f230ea

SHA256
6f2eea4dfb057cc731398c157351fda9d88b28214a75e10d5a5ff04ec3e31067

SHA512
45b59ec1a73cfe0f45e684fc515d26be69ebd9a2e8c934f19d1106b248986d4f03b1e1344f110732f1be08f496f47cfcfefc2a0271981dc8629bc9cebbd5d637

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
533B

MD5
0a305a2b4ef79e1d5c7dbfaba3cc0c53

SHA1
7f03d79026d3890043161d2f69cf23a9dd68aa97

SHA256
f47a458d06015e92390f792b23ea13250e53d05b129660929894fdf048927d56

SHA512
d0423823f9c4a482026291e5cfdad3af7a65ea7f18d51b34d7713509d971d05c1ecb54f719f5219a9c85adac5615365f69efc4b859e027b910ff1dc2658edb3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b428.TMP

Filesize
202B

MD5
8e43214e5c7046e275dac1222d8ff120

SHA1
9d697dad50c4934e515f81281982495b803d4d51

SHA256
c85e711f91625771a46f212e3016c2368514ba1dbd1b5e82fecd84f0b38d626e

SHA512
4d035f15935ba4ef42ee4115914810a7968a1500b292de4b24fd479beb8e4df767f44fd0ef48c9d6582c91770276e8639b163e87c30c100b5d067f11818cc762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
8b3ccbad6e80b475ba902d0e2e06f2ed

SHA1
a692a64bf432bd98d449ca7f19fe025fe8caa23c

SHA256
11ea6464cdd9f9606a14f17cdac3cda2871f7e1ae8bd9fcd951b2cfb492716fc

SHA512
36205fb500891fc8bd738a27a7fc15fa6caf5d011eff6374e64403559d424f98eb1de8f99a78b2bd78738efe1b838f2ff1ad6b4cada33578f9cc70310ffd9a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
31e81e70950115cf9f46623fa1f70ee7

SHA1
9d869339dd0431b40464ad81e0437fbb02428b6d

SHA256
cac3c3d3e22bb21c4a95d93ff6716b0a0129e49d676eed73c8e19af3f2cde3b6

SHA512
d93b6e8b2051dd79bc9479677e028ecbedf51ff73e7e7459a8acb7ade2e3666191266d29b79dbf7f1237a89e796ebc4e50db6c1ca20b6cf46248f6c5cd1f7619

Download Submit