hxxps://www[.]google[.]pt/amp/s/mteKH[.]politismoskaiperivalon[.]gr/51327888mteKH2754QdRb-aGVjdG9yLmxpY29uQGJvY2FyLmNvbQ==-51327888mteKH2754QdRbmailingcat=5&mailingid=17643832&listid=12176940&name=commander&duid=5e9a099f89d13929c012ec6c&cuid=5c370d1b967bf

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.pt/amp/s/mteKH.politismoskaiperivalon.gr/51327888mteKH2754QdRb-aGVjdG9yLmxpY29uQGJvY2FyLmNvbQ==-51327888mteKH2754QdRbmailingcat=5&mailingid=17643832&listid=12176940&name=commander&duid=5e9a099f89d13929c012ec6c&cuid=5c370d1b967bf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
3364	msedge.exe
3364	msedge.exe
1540	identity_helper.exe
1540	identity_helper.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4508	3364	msedge.exe	83
PID 3364 wrote to memory of 4508	3364	msedge.exe	83
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1976	3364	msedge.exe	84
PID 3364 wrote to memory of 1924	3364	msedge.exe	85
PID 3364 wrote to memory of 1924	3364	msedge.exe	85
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86
PID 3364 wrote to memory of 748	3364	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.pt/amp/s/mteKH.politismoskaiperivalon.gr/51327888mteKH2754QdRb-aGVjdG9yLmxpY29uQGJvY2FyLmNvbQ==-51327888mteKH2754QdRbmailingcat=5&mailingid=17643832&listid=12176940&name=commander&duid=5e9a099f89d13929c012ec6c&cuid=5c370d1b967bf
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1b9846f8,0x7fff1b984708,0x7fff1b984718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4947285051063570307,2632469725821005298,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
207KB

MD5
e955953b801c04327c1e96c67dd3c618

SHA1
f9061d3780f153e863478106bf1afd85132bccb0

SHA256
e8965a2d52ef25918ebee58ab6971745d396177a7943acf1ed53a65bb4dddd45

SHA512
6318ff1eb838954dd73dab5ed891d47f4f39089fa5e899d30183c32269c5620bd09d169af4cf8303e3d5c2ebab23cfe9ae5d9fa5c3281023abb009f66a25782a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
597a571089d5fe71d5ae4c7ce31b5d9e

SHA1
ac26e9e196a83ede4ffb4860ef7712d15f7150e5

SHA256
af4bcdfd6545637033822979edd05f137f6f35e21de216612801974810266761

SHA512
ef58281006c419a26c7d5067a1d0a7a62282f363f24c5f155a11d7a916b8c66c0e42365040a04eebc37e344f3165d6f12a56ed63bf320fa5ba0fd528b681cbb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
cb80e683a2b0c4fcf1081b7d27eb426e

SHA1
55953d33a00c09fbacb8b9cf4876371b590ae9d9

SHA256
dfc7c720d63903efc92322df0f5a3638005501459cd0850a926c122068a1a920

SHA512
c1371eac2ccaf0aa313408472bf2107625a3ef2733d85650533f7b63b73511275ac7b1833051dbab9f46edbd75411a87cbbe6201c628a81ead845fb2918e9967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2855e4f6b8392c02de430c7a521b14ce

SHA1
6e9c537faeb56c9aa4b8bfdd95a1156926166752

SHA256
49c97cfdb83ac85152fac12b9971243462052c0770a1acbae1f43f54804ac49a

SHA512
0d0fb0ed0dd256e4a221bc1df4f92eff17eff444fcd94408951a39ae7be8c4e0f5b5727679806e1128f3e503b7841083c032952fe7f9b4486f8287ecb785e84f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51f9381ddaf27b3ab57bda149568baa1

SHA1
4ca77cc7b8741882bf44a96605c6e31bd9e05aee

SHA256
be903576da6a9d3579294b5454894259401d88f2ab4e36135bf5601a9b0f8c06

SHA512
c0a3ec65d2202ac173200a8e964ba782223eabf0f75d3ad7060ba51bdbdcef8f1f6289db356c775048da099334ad1f6e88456946f19f3fe2616579238c91ae74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc49c0eb1e4bbb94004feceaad08804b

SHA1
50caae51e089f031875cd2736219960fc953c88b

SHA256
e838d4810e31cdd42a77755445f3cd2c8b900b459b28bf6929a6c74b0d0ec51d

SHA512
61889279579f6cd540a4146854758ac21bdaab9f318bd82b7f1dd69f33d5e97aa7b2f5ad69e2e0d7c05cfae99f3e86d0439ac4f58ed84f70450a6c68a8fbc9ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22d7fae673ec8c2342f8c50afb4f23ef

SHA1
a0d113cc91a5a50c286012b7653315a99a21124f

SHA256
b93e37bad2a748a6de123a7ca162a858402021db5f8ed7a2700f53e69f753229

SHA512
1905e1643c38d7179324b830be090a9032f2e76c761fd67ff5dbe2a287378c1ce7c9ae715037076f04f54d3d3500f50dcb7c4d689acafe0f8c4da5aa3770187a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
143a901db565d70d30301b7aabca9959

SHA1
1ad2243a4f51555fdf11ecc826595f67ed805030

SHA256
3ff9aa59ed06d2c2ac6bdafd3d0b23d335bcc3111a659ef57df66a938594e0b1

SHA512
2c6e9ef0141ce646e5fe0ab82ab9dadcd4009201459b90c3cab442bb1efd0c333683fc740ff4b8aa6eb3bf96ef879f5316740c2fd673641e43960c64787aa9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
61f2530a031d155b30dbde6765900c20

SHA1
73bdf4a39ba20818e7128093f3c5475c37a417b7

SHA256
ae85ac34bc1edc1ea20f55c2f010b43e733422694f60b368d05a6cc1b0404b87

SHA512
d0872b94f1c4f5a73025e918e4e52f4ff00cfc6f8736fdc266446c5473cbc41a5320ab1aad02865313de8628e574f1bff17b438eccaeb2e3e3bb93b697164a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1d78dc44eadf741f506368eea92b4b6

SHA1
98d0657d342008ccd31c3573795c6000c7c2699b

SHA256
c07870c44f2cc1da18e16a5b1259fa458abd0ed8b37721fd2398005bf060c44c

SHA512
6b60afc1e0c3d5cb142fb7b4a3939f18114dd49d1a1f196391807c44c5ab0363931144f99ce7578b177fac242ed96b1c9e2bf72c39e60d6e02d93198bf2d636e

Download Submit