hxxp://jch[.]org[.]za

Analysis

max time kernel
297s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://jch.org.za

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
1944	identity_helper.exe
1944	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3020	392	msedge.exe	85
PID 392 wrote to memory of 3020	392	msedge.exe	85
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 2728	392	msedge.exe	86
PID 392 wrote to memory of 3360	392	msedge.exe	87
PID 392 wrote to memory of 3360	392	msedge.exe	87
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88
PID 392 wrote to memory of 2092	392	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://jch.org.za
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa90e246f8,0x7ffa90e24708,0x7ffa90e24718
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8376022526150624739,5002786154947574134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
272KB

MD5
93284e7ddbddab84752685fc075764fe

SHA1
0ec91f96d92a22f11c1c3593c4fc5a4c3cb30815

SHA256
7c92de28b2f3e823e57e416ff301a25c48ad4ef84794079655634d95626e8616

SHA512
58350cab8b81dd2c40313a53228014960b28d015c90b6509c6fbc9840f113ab0763001b52ad0e2fc4fbc28766e4840e1e8b42ae350cb05504c509d4369fef5dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
b72e007d5240bdcda07215951eface05

SHA1
40ba3427a5a449e38b6b17a7f5a0bc98a6c49351

SHA256
2e535e647866fb7ff6b8147275e2dfe512d61d2357241cf3415f7ac745ff240d

SHA512
0b35b9937135490919a76a7199700d516a3bbf3db6018e1794759f1ab2d247ef1e0b62c4a15626bb992a71d20d59a4fd7b257325df09605c7444040d1c7ec377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fadf78dbafd61d788126b8518171bbad

SHA1
18077d68b386f4d958766d9cfcfc74a28be838b4

SHA256
5958ca049d035cd92462e4584dd0fd8856393301dd41a26bcd8b12673aff725a

SHA512
ed72bf1e95b8044c4d9ee267b2ee608075b04d78cbe81883dd63cee7193803fd4a16d7c2d17583a6dd8dad317440ef9fc0d44da74e382b3e66dd73860768fe54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
822354dfc96e11d5730e76b273dd492f

SHA1
2326bb229064ae8d9b40a15d3bb34ec86effdf4f

SHA256
07653cada417b267d443ad960e8bfad63778b6871cb65988ddc84e427027e048

SHA512
292f5079c3103265e08fa81d1930b9b85e65c35df5b37d6f5adccd8649f5f13940d22b4489be3adb506611297f349d1fabb6e2c8b881c787debb0ab3115e2457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c4c17a2aa46b326598bb60123e2c7187

SHA1
3b0b01676498c48e1d6580362f686ac68af83fca

SHA256
5ce451c1010b095ef3124cf1102878430b8709215bc82e632ae13894b31a6288

SHA512
79dedce752c5ddab14d9a82e806b4388141191c03ae637b5fe9e083c8e719d761d20c5649b785f40e860943b271ef10b8166e6d35ad91025d98e427ef8bbddb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
254f8f7587c6085cf226f06162e435c5

SHA1
bbca5b65eeb6cfba226609c8d14552bf46f2a6c1

SHA256
dea21125f74d3fcfd33558e9844c00f52575534d23ca9ef41c53085d2399ef6c

SHA512
8d6bba2d2968c5f3f7b54ade31775bd7caffd892abfcb05d1cfd91274d1720630d6e8f2d86f67496e86e20d1a592598e975b121bbd4e3a7ad638cc103801f5ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f38e9ce185473da4bcb9426fac54d83e

SHA1
91b35792c40bc44e0f641ff25f712a745398be3c

SHA256
d3a84876eefcbf73d67ddd5553b9b772ee07fffe9c701cadee16adcfec5cd415

SHA512
438e5c7ae548a922af71a3e20bb181a4709022f2bb0926844098dac467e75d7822de5013c8dc8d8ebb3598c2b10c7a666449a4bc9597f78dd8e8a80cd2486547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
42f10619ed7de833e58642fcc0e0c751

SHA1
e43bc4e5fa7441edc6321c0f5c5ed18b7c3abd6b

SHA256
258ce785401e6f4d76c5611e973b69e29a374e9b7021b2a68fedb02c716b5d7c

SHA512
604bd473f89b136ba6e7dfc57b364adb2f856274d3fa1ddc3cac5ebade6896b6a404dd60e730008d1fc176442c1fddcb6b6490a31af35576662ecbf550fbe5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
224cd33848cad6e3cfbd7418441eb061

SHA1
a2995c61ced1c90d21495b40e08407e5f32cc5ef

SHA256
006b13efde2521c4a5d40557e4ac6b9136fcce6f87df5e710615d38c9c2e2cec

SHA512
0575f29a92e3e1d2bce35d1bb5e40afd67fe967c1da17016f306229780d53dd025ee397b6433b303c1d047e60d913c5746f90957cdf148a4321bd510ca1293ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a54facc1637c04d862df49aa6ed1f1f

SHA1
96178ad1441c28a6dea55eb2e23d8929349ad4ad

SHA256
0745195e9c58aa2cef3ec28b4fd580f08c52f127617d87d931aa1453c95e0bca

SHA512
2c578979e1b1349800c069c4a9fd1e24802bedc13bb5b5d9f3b1911bcfddabc6109ebd850c5e1cf90231f98465708fc1655c05c2c24f5f87b654718cd520b65a

Download Submit