hxxps://smart-doc[.]ontralink[.]com/c/s/6jUq/u9/6/D/s/6A64n7/vQu2xqxmyu/P/P/e&data=05|02|catkinson@wilco[.]org|e6e875406cb24782b40b08dc695cae8a|e25da04722d04e2ea07d9d98221979c7|0|0|638501093995545226|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=|20000|||&sdata=FxcFQCgJ+/tGeqfFX/6d2kmwKgQbaYuuPa8pkHoxlDc=&reserved=0

Analysis

max time kernel
78s
max time network
81s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://smart-doc.ontralink.com/c/s/6jUq/u9/6/D/s/6A64n7/vQu2xqxmyu/P/P/e&data=05|02|[email protected]|e6e875406cb24782b40b08dc695cae8a|e25da04722d04e2ea07d9d98221979c7|0|0|638501093995545226|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=|20000|||&sdata=FxcFQCgJ+/tGeqfFX/6d2kmwKgQbaYuuPa8pkHoxlDc=&reserved=0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1380	msedge.exe
1380	msedge.exe
1856	msedge.exe
1856	msedge.exe
1588	identity_helper.exe
1588	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4672	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 3372	1380	msedge.exe	79
PID 1380 wrote to memory of 3372	1380	msedge.exe	79
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 3364	1380	msedge.exe	80
PID 1380 wrote to memory of 1928	1380	msedge.exe	81
PID 1380 wrote to memory of 1928	1380	msedge.exe	81
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82
PID 1380 wrote to memory of 3848	1380	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://smart-doc.ontralink.com/c/s/6jUq/u9/6/D/s/6A64n7/vQu2xqxmyu/P/P/e&data=05|02|[email protected]|e6e875406cb24782b40b08dc695cae8a|e25da04722d04e2ea07d9d98221979c7|0|0|638501093995545226|Unknown|TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=|20000|||&sdata=FxcFQCgJ+/tGeqfFX/6d2kmwKgQbaYuuPa8pkHoxlDc=&reserved=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff25083cb8,0x7fff25083cc8,0x7fff25083cd8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,2040155625611643138,5821581135600148210,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
47KB

MD5
8b36f388f14cbbeac9ffbf1e27d6111d

SHA1
e21872ffb8400e4c00c27124a01bc2f6d5d66c33

SHA256
086df88a0462fea78866488d59d103a39bc78929e1f38a259ee3f9e23a8f7b03

SHA512
21422b1c25a16fb8f49554ad4f522bc4207da534fec41ad342724779bce7277af4a83d939bee4c4aaead6d9f657b00135ff4a4f7e47cc1efa0933ca4a7dc1897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
30KB

MD5
e899c899f40def09e21861369fbec01d

SHA1
bb4c6ba276579fcfd20008286a3a179a2a462db1

SHA256
201e676d6c9226ee3bf65663e88edc96ac5270f0c8dc4dc9ea74c5cf32c194ec

SHA512
ace3106af6e19d119fb7816beece4200a34bd5f3fbe7324ed991fc023dfd1ebe98bec96ef363bf5e82196463630b180d7c0f7cedee9e0349c81667df2911393f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
107KB

MD5
2dd37e72e916c13fe6a4a2e0aac9e52e

SHA1
e951e78119ffecccba0b8346ebe79323be7c8764

SHA256
3fe51a16c8776cf0efb5940ac7bb06221d40a874c9770a2c05cfd0fc129b0df9

SHA512
edcefdd98ced802359c778a99a19de135a2e040360d15453f4c3adda8064b8bd37be47c774486b7a115ef434f6d7939759e359bdad4ddb7167661c7e79e03e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
49KB

MD5
8a62a215526d45866385d53ed7509ae8

SHA1
5f22bfd8ff7dab62ac11b76dee4ef04b419d59b5

SHA256
34ccd21cf8cc2a2bdcd7dbe6bef05246067ff849bf71308e207bf525f581763d

SHA512
845f721e564e03955c34607c9c9cf4000db46788313ebf27c1d12473c7948cf2609b08b24093c5d01f6c97acc79456e7aa838c291462bfb19700bbfd07ee243f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1c7eca280a615cb5b52af64ff3e81067

SHA1
937dd5166b3ad60ab4dff3198adabec04f10c07e

SHA256
881ac04ca7d52dfde12fb87863d1199618d6dd5250bdcaddbcf340bb55118dab

SHA512
f71cfc39cef290257d10ad9bd8a7dde45abc5544359d367b3dc32e5554785224a045932e4acdc0831087762a4a7773ee0cb24e00f7c03139c88084d9ab6cc2c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
75018c92160493022fc55814ad12a908

SHA1
99979a63865eb689691dc20b8a8cfe8754fb6628

SHA256
10479d7a7c32ee78bdf97ece24cd08ae69b0930277ab3b2e1e0c42a8b2dd997e

SHA512
53845a2244dcea8613d48ee232f6b8ac6ee0c98198c32c4f25d12c9a316a1a0b68c763fdd7887760d8ea0bc9d0525885423890984604df1fb7a855517c33f5c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
468ad10a08a6f50179b06f622f71059e

SHA1
aed06d6f5b0f9fc8a8f848b7ab7e51f57b8dd909

SHA256
e80258fe476b41bde7b534d9482133ef8f82125d359ebbf92d18d660cef2660d

SHA512
468e47e0170d7cabea7aebed9ec036b575599a67aa28b57e72c9ed4367b7fd6609385c7e9c5482bff1a37597f79bbb716b52550acfb1069ed6408a32ab8756a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e6d19e6a8b880f8c57c7fc2bb4c2be80

SHA1
7d10b7962c15119b952814a80319872959080b69

SHA256
9cd78907f490c07730b8c4120f384a68a3e9f2a78e184fdfd0e0243b7c67f172

SHA512
4cb334237fe61ab6ea7fa09eb6ebb83b43305279655908d294a0076b2e6b48bd823edf4bb2f84a6ab2e27fc1c80ca649aff3ea819435db956e0ff10f9c1558d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1cc8fad3fc48f7f9c33d7987396c384

SHA1
f9c16688b8948ffcd45419c27fffbce91ced8317

SHA256
3cd4887144e8010705411f4cddf73d0ddeb2be4c0ce1a1377a6c3bd1c4aa56cc

SHA512
431ffff75c23538c91f68732575e84835269a390e925e21d316d92017d055661c73e4e09621e329cf9420f7572c446449294aa59dce49099a52e404c091602af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eff1b6203ce4f2157a0e5cd93cd3a9d6

SHA1
3e816078a8904c73fdd5e22597bc4a1bb51c14af

SHA256
a8dbef898b9a9111b75ec3ad396e74baba09603670c4c51647980f3ccb0c866b

SHA512
d13b33de9a82829fca1acc7d78cdd97193b71f7765a0b64b96f60880cf0c469562883bf31a0b9abedfe831f916630599e16114ba03d030e2577b40d783d4642e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e66d32c2d71651460e7c2439936430dd

SHA1
e26753d2e05858843eca05c17b072d6a7c3e2469

SHA256
40ccb5857cc17c2927957f391451c8a6005f309946cbf8c2d06fd039a5064d5f

SHA512
91d90b7a47279468af8cfb223b0d15b85c31e9c6a4908e456c5365b72ed3ed3f3e25419a3d60e1f57463ffbd6cf607604892d25aec820bf2096333f5e8e4d0fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
85dd875522f71e55ff7d64e4d20d9e1e

SHA1
df562071368cda733e1d7961cb7d1d19f86a9330

SHA256
12865fd7d04473a938dc728eeed1d42826e0ef409427f2f6fdb876fb15d694fe

SHA512
15bbd9fbd08affabfe8e578badefd16c4526f946127849e220a8f268adb4b7aa6072f00ba8b4f63969db65cf222e03f55ab2a7111c02a2d91f3f38b93fc1ef32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b391.TMP

Filesize
204B

MD5
4179bcb50e73bc03a9ef13c03f98095f

SHA1
5ff8ecfe00d64aa84ed4d19389a593b26251d668

SHA256
f06b31281e448a0437f0b0ebf70e0ba132d80089951c21683dd9b07d1c1d1d90

SHA512
7905fb83771d8ea1041526f5c658ea1772d0c773bd216f3b6d7619091f04e773f90554898810385aee3582a6ca8006af3f10f6e15b50b43fe4a66345e6a43e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22cce2928c4f9a7e7d3d4dda2190cb4b

SHA1
e56be8825a4202d12201d35ce326af3ea239ec61

SHA256
c1cd2a4ef07f5254500d4917bdbd5252b49f6ee648adacf6d7de37f702c29129

SHA512
6a1d704f1afeede89afa74c445b74bd2c2bb58623cc96546509c960f792aa1fb12ed25ae530cc00df8d39aed263bb1ab95fd19b6f153ee92eb602d9fd6f38186

Download Submit