hxxps://click[.]pstmrk[.]it/3s/cyber-risk[.]upguard[.]com%3Finvite_token%3DwejTrEVXtEj8JvTyUrLti0yMMZEci-Z2uUFXBGeUOHVd/c5RR/zXy5AQ/AQ/93792fb9-fa28-4ad9-a298-c1c9019886b5/1/N_HjYf-X3m

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://click.pstmrk.it/3s/cyber-risk.upguard.com%3Finvite_token%3DwejTrEVXtEj8JvTyUrLti0yMMZEci-Z2uUFXBGeUOHVd/c5RR/zXy5AQ/AQ/93792fb9-fa28-4ad9-a298-c1c9019886b5/1/N_HjYf-X3m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2924	msedge.exe
2924	msedge.exe
1996	identity_helper.exe
1996	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1476	2924	msedge.exe	80
PID 2924 wrote to memory of 1476	2924	msedge.exe	80
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 1684	2924	msedge.exe	81
PID 2924 wrote to memory of 2772	2924	msedge.exe	82
PID 2924 wrote to memory of 2772	2924	msedge.exe	82
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83
PID 2924 wrote to memory of 3164	2924	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.pstmrk.it/3s/cyber-risk.upguard.com%3Finvite_token%3DwejTrEVXtEj8JvTyUrLti0yMMZEci-Z2uUFXBGeUOHVd/c5RR/zXy5AQ/AQ/93792fb9-fa28-4ad9-a298-c1c9019886b5/1/N_HjYf-X3m
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0d0046f8,0x7ffe0d004708,0x7ffe0d004718
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15572754180828681143,8270577856010980769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
97f8be9c465b0ed67c2415868506c354

SHA1
cdb221d6debcf55615d3b5f30796e32065046dd9

SHA256
b606a1ee10b65eb9077e7d2f3b34a0d7a1ed6a4802a169fe55449c975332ee02

SHA512
a0fe0ed30624658127316873137f4fc488a5916005e5e3f1f55b7d6442b54010c08d7037b94d0cf3c3316b1bb4acf91bad9e64ee6d15302e3cdd62bb18730542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6ae84fc1e66cbbb7e9d28b0e12d64550

SHA1
100430bb653c896c11b94ac0bf2297a389ea5ad8

SHA256
856a9c0ac8c29f738a3501b6bd007fd8cbbac211e461b91f4caff52dd41da75c

SHA512
7fe7a8639d96118b843e67a6a6d397271b181dc6b049e6f7de77bee9c9214690b1b7f73164f7e463e117406dc978334ea02397fd639140598f60f89c6aaddbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
62KB

MD5
9e2de1d8635818887296aa4f766695ba

SHA1
115b51fb88e1a8fe6d6418ba1c80a3ec8c0f82e6

SHA256
854da95bd0bc3467abbe8e5460b207ce30029a8df772d565aa846b08472a9898

SHA512
cb7317e5a1958ebdc3be293fc67be35a53431a7cb85bcd4602c72112a519a9ef8f42cb3d78ce095a67a9d31f2f02007bb9469f7a2e908bd8d31aaab03b997ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6fe3940e50f1d03df0403d10649e5984

SHA1
89a2bb7b2cdde51a1eefefe973a5307e408f46bd

SHA256
2aeca1d8f345facaa2b895b3e21880c0b93c6d2201c57be7cc59da46f3c9b42d

SHA512
ce970115af390d0bd3025daee977e743a5bda7aac39d97c226b039db20addf914b1b76f821c7f0b426ab905b0d39a23dcc7136effdd5b37db1e6c3a59b7e598c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b65020a06bb41493df9028ce48dab6a

SHA1
f24226ecc18cfafab97c498b9dd14fabbff0034f

SHA256
241d5b251fe24e2284da3bff7e4bc478014afd615eefd5b9d7ea5dd4255c86dd

SHA512
6239ac8a80ab0029794cb2991f5b4acb2c0abe6a958750a0fc3d949ea34a09274d3e1330c6e03ae2267a081e47c4181945d08b6bf27abefa158c9b17581f95aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c7a222462c0f4ea7bd1a77fb6f193f3

SHA1
a1aee1108e80297c28940617bd88563a027de301

SHA256
ce7e33365408af160e287c276f6b9c3e7dba416331298d65d3cf840fc3fd8804

SHA512
0f139c2bc2033d0f3d66421bc7bb7d0588938d1c7586e48ec9c6eae6fa604d861c32b66aec984c6eca2d0dbdea9ce5eba71d7348792f97e9ff4c0867491d796f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4d0c38c2aab95f387b8dfcf1108c382

SHA1
7a06da6c99a875798259445c013c43e1b3a56092

SHA256
b4e45094b99f9e9c542baf0f850b9c033c0fd563c57b327c1de860af5cc6199d

SHA512
098babd0c9b577bd4da35b6e648ebceca9895bad131d72e0c9bc4737afa5750dbe7eb57d5f14d67baa616376e959df8508b173553f438860d669620767dd79c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f168b18b2bbf6cffd2d4bc277827d13a

SHA1
4f1b037cc0ad0209b83106964af670cc770666dd

SHA256
6fbf7488ed4244b8df177252f3e0acad9052bd46b1196c91f9159b3e1908dc72

SHA512
2b9fe6bce06f8c70bcdc339f50400a0063951258bde542c42042819631e5727af1d2aea9afb96d07cef18e454d17384bfb682cccd35cd197261d09451adc0230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a5f25e07e148ad2da97099aa4982cc3

SHA1
ed6aaa88ee16d9068134df832e5c33f1ef194711

SHA256
6f694f3697455c5fd4ac9b52b283af95426de94090263b239f0cc12a3f47d6b3

SHA512
8fa2c72ee9308c7959e972a87682ffb07bf3701048ec1645cb03c672cd6ee912dfd8de1e15185210d4b26d4133b91ef06595981c2e376cedb381f5bcbadd0b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593cf0.TMP

Filesize
1KB

MD5
50832ed60b9c3ec48da0d16f28bdc260

SHA1
b681fc857fb01f9a44ae5b082bc73298950b961e

SHA256
08d0eda2b98514d9103d447e69907ddc4eaeba273bfad21e08478ff37212b7e7

SHA512
7f98884ddb24f4dab28328bbdfd345f4d6d843e827e78621d64eee7bc2eb6b07d905df792858ebcdd707e14b4ddb86a8c8a6dbba7e8e94075841453527e49625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dad6681b2cdfcb8f9889a83973a42944

SHA1
d48ebb4b2d56187ef82ec9a56b5ca2ed455838e0

SHA256
631604c44744810c868f3d0eb65919ae653ac5d2fccb70e64d637b1637467ee2

SHA512
ec4a5a1205d4fc6c6923da15e18f478b83de1969302b7470cb2111b289ed3072002d955dd91fb719a4cbf5846caa24c0ad2cae2f07efed78ba402e21902b273e

Download Submit