hxxp://www[.]burgopak[.]pl/

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://www.burgopak.pl/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2544	msedge.exe
2544	msedge.exe
2500	identity_helper.exe
2500	identity_helper.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3492	2544	msedge.exe	81
PID 2544 wrote to memory of 3492	2544	msedge.exe	81
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 3712	2544	msedge.exe	84
PID 2544 wrote to memory of 2456	2544	msedge.exe	85
PID 2544 wrote to memory of 2456	2544	msedge.exe	85
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86
PID 2544 wrote to memory of 728	2544	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.burgopak.pl/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc53df46f8,0x7ffc53df4708,0x7ffc53df4718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8146214961760593713,16562719897835491193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4d8 0x38c
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09c7ae658385f6de986103443217840b

SHA1
298d880503edce4413337c09d3525f27a2edcd28

SHA256
91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

SHA512
4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
37e35173a07cd9f849f525a6a93c13d2

SHA1
99a979334603f7ce3081d328a43e8904b6190126

SHA256
4d80b0d551dcd20a8a11a2fb05c6577404728746228f7f174ff2099b8daa05a9

SHA512
18210c9f65fd9579bc22619719f7507e6a77700b425f6a7467aeed231549e85e3415768e815bf20979fc9343ce41318542d0bef7e8925beabfd13f1bd7802615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1d3b0e24eff0194448cf6329b00b6c7d

SHA1
8d254ffbc7b110ee1de5387a25108719e5b1adf9

SHA256
14f300bc0a7befb6f46a7e0da72bc8d47f813738042cae5cdda7cbdec152cc42

SHA512
cd6e47de3efabe6a42afcdcffab70af2c44adfd22804c5d67d31358422bfdfb011b8bc494448f9ec2b96a11bcd4cc5f78bda6fb0a2d303f0dd8919c6f28ab276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e06f5ab4ee2140a8a1d172637fcd45fe

SHA1
6c12d895b40f609a64c92b69d365bd42659864e5

SHA256
4170287ecf538ef74add9911471c9ea68f2767ccb6ecc69446396d653441cdc1

SHA512
a417bb12f3d3fa5f2023ac2f04a7a9007bd781366bf54fec8cbf4029be5533e9f6b70cfccc56cd9df8d15daaca9393256b5d4b2da8366045fb214668072bb166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbc134ce51cce5fcb01d40d1c64b6d5c

SHA1
e9af700062db46a1c79c835ea290cad3280606f1

SHA256
66a1c347eb7a48a107574d8396ee7857a0a529e54fa1a7b972874cbdf8dbca48

SHA512
0f260b87f79540b4eb43a70512132e80084dd9e791e53ab3a577d246434c05fd4ad783de18f4a3836bd3630d28b3d1e9e22fc5e87713f3dbd75b9da47d588766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3987ba029e936f7bd00efd52833ef5b

SHA1
1abd49e5f874827b4a7790e4c94904c9bca25d77

SHA256
b8373d9efe83e1b5f920306444dba0e7b4461a464caaf9d89302324f294773de

SHA512
64c62d4141f0bed016496915f231d2af0fb3fc2ce380ff8a0eaee21442c323ca345c4ae04abfeb790a69aa07caa5f3d3a98de73db4406d4d4ad80d3e132bd4a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a8309d8b379f06e2f08ca344270b42bb

SHA1
f9c15e8a1859071b28838d2d5291ee1e1804e2c9

SHA256
0b8681e8598588e7dd615f788efc7b02285006233692c6f7bb7a04a8d64cff24

SHA512
d15e0b51bac27d4b6ac325f24d9c46636fe733393d16604ec34e366b8484e0dff21fe1f8761f595fdd0eee8f325e35e877171fb5ecb8909f720e773ec91fb4a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
19d4c72b3d1167f0fac8816e42c0b26d

SHA1
f962f75de84e35da6e84d1d79b30a17d25b2c02f

SHA256
eeada16094913d664fdd89d7e16b0c488f4a99f43673c199841f9ac38159169e

SHA512
6b0e1df5835a4c5953a2dbea0dc19e312c862f4b01ff29d2cd465148cc306bfb74ae537c4170a602923679f77733a94f52acd13c580734a16e0bdd4a28194b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ff434e835e64d0309c4490ecdeb57ee

SHA1
307611a70250841b745f5b0667b1859745710d0e

SHA256
541262be87277d47cb2a38be4e9ca3e8941f0092f6ee1f17912a55c0595c9c2d

SHA512
f8b5073d81b12a62169400f835166dc1694e1d4fade66a9b1697181ae26fe1a5ee2d8bcc529a278a3a76cb068b9f3d605e7d3e8f5a4dc3652001f2a44ca8a79b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
17ccc01b7c9622d3701cf733cf7c91a4

SHA1
5dabc296f52d02e3c6621d773bd16e429b1cce1b

SHA256
0fc82d7c03dafc7e25d0725af8a490f88f800ef162d50cea0409390814413ca4

SHA512
0610d8e81eadd8b8a020f10cd1202b32394dada1239a907c5019bbc310aec6436331f5aa3e0016470d06550de85372caf9d173b8339de05f13934652015d5f27

Download Submit