hxxps://londonreferral[.]com/

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://londonreferral.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
776	msedge.exe
776	msedge.exe
1628	msedge.exe
1628	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4368	1628	msedge.exe	82
PID 1628 wrote to memory of 4368	1628	msedge.exe	82
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 1656	1628	msedge.exe	83
PID 1628 wrote to memory of 776	1628	msedge.exe	84
PID 1628 wrote to memory of 776	1628	msedge.exe	84
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85
PID 1628 wrote to memory of 920	1628	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://londonreferral.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa047246f8,0x7ffa04724708,0x7ffa04724718
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1253046790788937545,17663565281143088446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
199KB

MD5
585ac11a4e8628c13c32de68f89f98d6

SHA1
bcea01f9deb8d6711088cb5c344ebd57997839db

SHA256
d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6

SHA512
76d2ed3f41df567fe4d04060d9871684244764fc59b81cd574a521bb013a6d61955a6aedf390a1701e3bfc24f82d92fd062ca9e461086f762a3087c142211c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
840B

MD5
053fbe3fb1986c2a28d31c70be13087d

SHA1
fe379e55c7688bf9b39bc5ed3486897379059887

SHA256
7de75ea68cc2332eccc6009c5afc38e4a5645db0b0bfed99570621d7e057551f

SHA512
6f2b08e43fded359e944982f63a7cb316133561c8a56a6aa9215ffe701582bf043836210ac9335bf5279aedda267d9d078d905d0e6f5398aa6bf73d39ae5cfd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c3e873c882a0589a1083f6fee931aa56

SHA1
cbe3ca554a1bc53abcead538d6a5b63caa4d39d8

SHA256
728cce2b60944830db0ac1291064b72c4ac5fa88102b35eb2e0bcc93d9c79152

SHA512
efe057f12e640e10ff562205d6e9ca04ca80564d45f48bbb46dfd5b27cba6e8044d8836eec88276512cd8fccf92eed27f9e7b5e1257132b7472a5a6a3db3b602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3bbc15eea15dfbed82b8ce99a1916524

SHA1
cbd2a1e7ad3df5fe6be660727eb3bb45039e004c

SHA256
648028d102084d28038755c51a463b816310da477ab03b6effb66bb4960296d9

SHA512
59a1a959c048ed2825a0b4c9489c6dfbed684a1fa5b86f406260ef281488440e4a149994a1fec3d3affebaa6da0f967774c91ab61d9b67dfadef93b2cce11553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4d44b6f7a623ca4e8403d25c93d40302

SHA1
e6cdb3c5b30b0a72dbbd6d2e3580505214b1838e

SHA256
27cb892c9d5d7be99168ad6fe621d14603b59ff9c987346faac05d43d738d91a

SHA512
e548688230fd33da534c0826c406461aaf1a7cdbdfa0632090d7470baa0dc2992c5643f78eb1b6c2b88b8a71208deeaf7264c725637aea2ab187a9ad2241354d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e48b471c88d5eb7791492008249a5b5

SHA1
1723b42721cbba3bf70529741da6984e5fb6124a

SHA256
15127ed5930ae75e15b43b146240f045a256ee0822e6054e08122565bc5e0d49

SHA512
04af110fec4625cfab9d626a0091dd44a91af1d18f01c2ff710f2de156ec6dfff25c8ee76d1474f7c8f4410bd66b9bc36eb3510c8b48ee5d9ebad9d88d43cedc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca63f925fccc4f00a4d6d0ddca9498c2

SHA1
b571ea01d201e90b73d7d6c151ac420c836bf88c

SHA256
f9711aadcc2981095a83e88f2d63bb3e540bddd2b20188aeda9bbaa2aac66ab3

SHA512
beb0a667262d7c0c482670931afbaf6c12fc1175cb0f395d8536e1cbff00c59deedfdc689e96f30258907251e6d1c45b6a6fea420d77504bd1a1be684435a23a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad692178279d2b26c4650eac2c658e94

SHA1
ff45deb87e2ee41a774e43ac13fe5024986abd8a

SHA256
a538e0981ba014534eefa5b68d02aa294cf3eb24973fa10db3a4731cb47cbe63

SHA512
d1b4d8c80b69f6fc2f98c9c83a52a35e99523e9f7ebc8f46a031f67610bf3a3f9210f60815117082bb760e350cc2b3e86d6ea312dea620f11b338a70d014fca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
40c067bb609fd6d6e839f6e3103db3af

SHA1
df2b769175c85eb4aa1d7f0b35dd26fff7b792a3

SHA256
3b729d6d261793f9e6e457236814f38b2f92ba135c5b1f6e1da2d1a8a5b164d6

SHA512
9f6a8c2ac4e26527b5d0e1d9ebb64674bdd963606148751b24de1eb982130d15f9c36a0370c73c24d3d09fc338331556b504c650723e9b6b2f86346c889a3320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fd8a.TMP

Filesize
371B

MD5
0e304b1e1ff25c2956637d5a728030e5

SHA1
408a9e81c4d30797b89b5c7a5f408567d5fd262e

SHA256
aded90064fa91fd55631a71546c9a086454c2122d42d20b1030201274a53a7d5

SHA512
21b124bd47cdf73eb7347e369e75743cdf2e3b49e077b13c4e12aed22a3b683c82021749f414795f77eb9a3337e4107f3df11703263e654f70121301613095b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10814117979edeb5243e52f9203755bf

SHA1
59e353693d4a1d4dc775e7f9088cbc1db9fb9149

SHA256
a1dfa94903ad0b849ce2f311e181f3e6d40c9eac2ae6bdef0616d1c744a98e65

SHA512
03f41020f8cf07c37b6ee180b649c96c7aa0bd2adf28ad4aae266563cbdf0937fc636e78827993eb91ef2785ab06160e55ea8c882cf8ebb1cc38ae98a6c9ffc8

Download Submit