hxxps://g4thqw[.]fh19[.]fdske[.]com/ec/gAAAAABmXoaQms_b22buBYuzoXj3S3NPF4stU1buDgJZyLLg9k1unND4Ph1LVJos4JompYyN8cx7bq0cP3nNsqDx8KFwFbRcLiOZ4U824nVw1lNx48zMXsUoXMIlzRah2gh8HCDaZ1gD2_ADVpvMr8v4CWCXhZKl34idX-1PhzSz5Zw4LPG0I04lK7hHD-wVWKIAezE6-aWXwF042whuwHkEs7L4_8maJnKDvX31nvpRlOVuqie52eHKKqv_MJOcmeiaLGTQsYTndoUdnqSlKUeqlE_RmzZZakeOqexuXrVl-8KB_Q0e9QOVGNr_6QhuGK35vgYcG3cr1ReIh8dk_aubFw8cbtDsiQKEQKywCmd5nthWesXravGy_bXJ9sc6Qz4aE5Y9YrCm7yNAPDZBpDUKih4Mb3BsjA==

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://g4thqw.fh19.fdske.com/ec/gAAAAABmXoaQms_b22buBYuzoXj3S3NPF4stU1buDgJZyLLg9k1unND4Ph1LVJos4JompYyN8cx7bq0cP3nNsqDx8KFwFbRcLiOZ4U824nVw1lNx48zMXsUoXMIlzRah2gh8HCDaZ1gD2_ADVpvMr8v4CWCXhZKl34idX-1PhzSz5Zw4LPG0I04lK7hHD-wVWKIAezE6-aWXwF042whuwHkEs7L4_8maJnKDvX31nvpRlOVuqie52eHKKqv_MJOcmeiaLGTQsYTndoUdnqSlKUeqlE_RmzZZakeOqexuXrVl-8KB_Q0e9QOVGNr_6QhuGK35vgYcG3cr1ReIh8dk_aubFw8cbtDsiQKEQKywCmd5nthWesXravGy_bXJ9sc6Qz4aE5Y9YrCm7yNAPDZBpDUKih4Mb3BsjA==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
4780	msedge.exe
4780	msedge.exe
2328	identity_helper.exe
2328	identity_helper.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2608	4780	msedge.exe	83
PID 4780 wrote to memory of 2608	4780	msedge.exe	83
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3920	4780	msedge.exe	84
PID 4780 wrote to memory of 3536	4780	msedge.exe	85
PID 4780 wrote to memory of 3536	4780	msedge.exe	85
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86
PID 4780 wrote to memory of 4472	4780	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://g4thqw.fh19.fdske.com/ec/gAAAAABmXoaQms_b22buBYuzoXj3S3NPF4stU1buDgJZyLLg9k1unND4Ph1LVJos4JompYyN8cx7bq0cP3nNsqDx8KFwFbRcLiOZ4U824nVw1lNx48zMXsUoXMIlzRah2gh8HCDaZ1gD2_ADVpvMr8v4CWCXhZKl34idX-1PhzSz5Zw4LPG0I04lK7hHD-wVWKIAezE6-aWXwF042whuwHkEs7L4_8maJnKDvX31nvpRlOVuqie52eHKKqv_MJOcmeiaLGTQsYTndoUdnqSlKUeqlE_RmzZZakeOqexuXrVl-8KB_Q0e9QOVGNr_6QhuGK35vgYcG3cr1ReIh8dk_aubFw8cbtDsiQKEQKywCmd5nthWesXravGy_bXJ9sc6Qz4aE5Y9YrCm7yNAPDZBpDUKih4Mb3BsjA==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf5d146f8,0x7ffaf5d14708,0x7ffaf5d14718
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2612790134455737347,13134796139172370062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
04d88646385dcd78cadccaab6417ff88

SHA1
f13ac70e34bffd37db96e35f989196cb910633e3

SHA256
bca58be2d0645f1a01227666a58934df41f3c6c3adff46ce60e93f4092f678e5

SHA512
224264729e2882f6bcbf7d9cbe2008d74d23f1876bab7a7c9f84853f255529ee6dc1e420448b70cb9a9a7c7189d756df8ff81969c997f1111bff0fb68141bd3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
95fc658df6c300835c593765d2a484d8

SHA1
7e15288a3324931f6c2bccd2b546f64c3b81f01f

SHA256
e42ac327113e54c22ff71ee4cecfc612af6bc03c18a76cdc55ac0ff5bc7c4368

SHA512
8e60a9717e6237e98035df1245fbc6641baaf21e1ad97932b7f542518cd7adde8609e92aab1b8329f86bc80b8f6c2ed7c86a58c38b870a3c6ba52c24484810ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7715587642a732fed97d0bacbfd7715

SHA1
7e0f77e40687094b84e785891b9cf600510b48ab

SHA256
b27c91c2e646928b6ccf1c574a0d6d22db58797305df3c3fdc673fd872586eb9

SHA512
b4cfa04fbd11cd129cf1f95d31aadd5f76886ba2cbcf28ab0aae99ea2ac0ca2d7b71cd066b7d898c178febcd6103e06e839cc2be095e4f9202c769d931009be0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a563befa2890eabb6e21b199e5cfd632

SHA1
fdcb64840ae91c69fb86039ef06b0bbf84c231f2

SHA256
8479fae82cd505e9e7e07bdfe0c29c2c2e490f11d8db891ade6be69d65f544e8

SHA512
2841f6ac3179e3a72e193653c7fa88af2560eed6f1154dd488af1bc0bfcad30fc2ce73fc17013f94526695d6bcf5fdc2e0f594be72ae2fd909f9f43c2f49e7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d57df7bdec78decfe692db2632be715

SHA1
5f0b4412573ee6f324ef730b56d3e78199afcfcd

SHA256
27d1706e6d76f69e2d33c12b13267866fedb0b1d87c50365a33270d3373f98a6

SHA512
a9ad35eabe17fe9cc591fa61ce010a6450ebe658fa3d9d1989d4204247200ce0865ab6fa13ffba58f3ca3490343335a5b8bdd1e8a840f7530916b784f1d674e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c644eec81f63d3a39f9e2bfff963d08

SHA1
4b2aad6188ddec91ba8bc2d1b35b1462e8724bb0

SHA256
684a85c1f29c06720e17d7c3197e137950b2cb61ca84f358c32c194b37c65c4b

SHA512
f5d2fb75d512d544c593a16b3879b5aa386c34a1f02a5d4714f892c3806d36db44fa062dcf789d9e1eeca42ee29e44890a856beaae722f82ac9032b7765a8e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58589b.TMP

Filesize
1KB

MD5
ea992b82c583d52ee21acea1cf825c4d

SHA1
b5842ac74de832fe6ff3a42148abb369d5b41426

SHA256
d0e84140012fa1faf49a8c503ab2447a88bc0f4e13dbeb7873f3aaaa25b416e4

SHA512
47e29bbef16f29e9fdfed1c88dd996a56d1ba4b09665092503b060291e728167c1a3c9a248a446edc0172b9b26a7fcfe803cec2e82d30885c36527333699a69a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ba5250e230ad662a5d8e3539f47db43

SHA1
a7309215d5287348756059195c09ff0333380158

SHA256
9858a495d3393171b27a28fabcfdcb5eeb7a9ab069184b1bf99e773470d9d161

SHA512
c6a9b819a5c8546d255131e5ddf3326f6da3aecf56a4b65dcd4374c453bdbf0eb8b24bbad7503ea4c330e99b478a2248ea4b70e72132e50718f5a766de568e81

Download Submit