hxxps://urlr[.]me/fNv2q

Resubmissions

06/06/2024, 15:38

240606-s22sqaga4s 4

06/06/2024, 15:37

240606-s2n7maga31 6

Analysis

max time kernel
439s
max time network
440s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
06/06/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://urlr.me/fNv2q

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
19	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
1216	msedge.exe
1216	msedge.exe
4328	msedge.exe
4328	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3156	1216	msedge.exe	77
PID 1216 wrote to memory of 3156	1216	msedge.exe	77
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2756	1216	msedge.exe	78
PID 1216 wrote to memory of 2396	1216	msedge.exe	79
PID 1216 wrote to memory of 2396	1216	msedge.exe	79
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80
PID 1216 wrote to memory of 4784	1216	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://urlr.me/fNv2q
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd1a5f3cb8,0x7ffd1a5f3cc8,0x7ffd1a5f3cd8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,18201798937901757502,9861105637923610967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
144B

MD5
cb792d419fde1096406cb54db8819007

SHA1
faa9c07fb36400a494d7cc2c23179693b2a67756

SHA256
ee9071109997f44888cc6a42641825654021147c1d805320dd260276a65d73a5

SHA512
afd03de456cfca43e5414b3904fe1d094b3ffc61bd72b3bc40ef9cee2e3955ac042add30d8cd995b0891e0fc29529c5133066f44903d3402baf2e62487fbd50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
efec69979b326ddde2e37f3ff90c9822

SHA1
da693f27a5ae6952546aa61d4fccdfcc1f973172

SHA256
f52bc09089c9d6caa8385a76bb5e1eed0f0e61951eb7d2d279f68f6c2bf51939

SHA512
7eea091e8ef8e3f050db1e2c82e03ef600c6bf712dbf138c81f4dd4c843559a8b0eb6ec9d0579133550cb1b7edbba7a7a7c900dde6da0e7938dde0f9258ec9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e17f61a49266066d563a5e30d43b9430

SHA1
89aece4348db7ed8ee8069cb76d1f47deab1633f

SHA256
b6b88f5e3f504f35ad572d6f283858785199680c5739b6ab19e035d4fb0f5b91

SHA512
4d0797562f9515da7f9bed395f75b81b130bba151498463a53216b570d5d91517335071d142ec5258e76e30faabbebf778c2a13ce0ca0619a08770700bfa3503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2134ab8bab90be2859f977426e18c2c0

SHA1
a55061d356ab432c5ef96d3ffc596ac59443ee0f

SHA256
10679245cef0523601babe81769991904a808896118aca7b7c669dc01041c6ea

SHA512
9d879612008775802bcdbb7cc2b7fad8458ba67fdd0913d0098b0064f16e5d62e8034eebbcca1569de134e1a71df7fbce9b7b287c872dd7158722cdbcfa182a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
29156a08e8b5f6dcbf539171b9616841

SHA1
736f5d2a60d8ab99996d08241c514c7a596e4de5

SHA256
d600ea4c09c4ca94f2dd7e739fd222a7b738f9fc1ebc817df2599056d0eea07f

SHA512
6b80fe06bc819dd43d433ec11a8aa5e3431e775225a640ea9b7eb7e14482b576feb6f20361dd9e8a0a2869e505d749a84e4902f6b4c5ce0575aec3f8ba107120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f30bb26bcbd5c0d338ce905ac5e58b3

SHA1
b1b9ab82355a06c8e72510e57b1dcc010e2d69fd

SHA256
ae0f80f8ac2e13ee9dc7c3ed45f31fc60bf4d5250801381cbc272c0a72f45318

SHA512
7b71ddb154c85e61185c9977c6abd645cc805324f3e989bd104465305e55a15e1a832f8717d1d3eacd149ce688b485195af986a3e07752d0e4976e94cd520f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f382942eaa21aefd26a5c84e6438afcc

SHA1
76456fe47d5217e7559c12bb2fafc3d6ae129952

SHA256
8fcb2fac4a5d5a925e348fecbdccf57c40fb12b2bf77978e296acf6e08e4a14c

SHA512
6f34dfff8a8331c5ed02df8c585f7041dc2610ccd3b82788e234b55f5f3fecc9edf35b486393b0a93ace1cd8ee6205f44de253f5b655d8a5ce26b3611d0eaf2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a89a8c7a4069ced424f23579708e8438

SHA1
9d88e39534cf0762bfcdc23071667d5e7477c30d

SHA256
ece8147b26d722b7b938caf4885a41d1a6801a5c02ecce8936b9a091348f614e

SHA512
4e2b050d59e9677ecae416984f792d67c8efd10b4712be32ef4572cb037ae895351222c9e95ca4eb0cdd6b14055fe46678c243ac275f8ffcd43ecd0e067628b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
169810b069b3f56458fde6a9162e1222

SHA1
b731f86c2d3dcec7a69054d160f32c32367a7d8d

SHA256
b45dc3b3d439b670ea5d0db79c8566c221b4e9d728a2f68f9b77dfe611ae923e

SHA512
b3bb86de87628fbf17bf83ad877a40e653d2c504a3671e3bf1822f136255338f5c8590eb2ddf67bdfb771218b7ea244c0ed6173e580563d8f086b503e0abe3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598052.TMP

Filesize
203B

MD5
8ef8d8f82d63c6bc4eaf8b7c70bf2b9c

SHA1
2f35254c61e2905611dd6faacf70162b331cfca9

SHA256
d15a40e012ac46157815a14b1184f0f051bad3cfa696f0f1e82ae626224123ea

SHA512
d4040f7ebd6f3389915610e5931b9bbc75021d1c915df507d28641af52f39ca5341cc136b9a97bc355b9efa18dd514773084874363a045b8b501350f2dcf1c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc55df788af69885f91c048daf6ae5e7

SHA1
4341070caa7481e2f089fb1f0a7065f4e9759375

SHA256
8fdb34894032a308dc6f019cae2278da19b47594233f43926e92af0ea38804c1

SHA512
ff82db219240fa41e3e4768d1a4cbd17f5a258513853c3a4347c6d2ad9643be97027ee7d75cba4d87ae52ab54d94860f23975f9b86c2e50bb38e9bac53618f2c

Download Submit