hxxp://dstokes@cambermarketing[.]com

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://[email protected]

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
2404	msedge.exe
2404	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5600	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5600	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3956	2404	msedge.exe	84
PID 2404 wrote to memory of 3956	2404	msedge.exe	84
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 2784	2404	msedge.exe	85
PID 2404 wrote to memory of 1972	2404	msedge.exe	86
PID 2404 wrote to memory of 1972	2404	msedge.exe	86
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87
PID 2404 wrote to memory of 1964	2404	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedab946f8,0x7ffedab94708,0x7ffedab94718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16421098643178850102,7141110786253398579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ddfa89cf84537969e28c6b0867f38891

SHA1
4ab534f48f550ed3f6d9ed99ad7622fc7cc8547e

SHA256
424480f2ed525d38262aced13f4cb46e449c647f3b30cf76567ca1bdce7fab5f

SHA512
a636be3035c94b6dd7984b5fbad97fd11d4b6ea46c4d828dacdfc73af1e1048cdc73461c79eeef5e4cadefb017f4e06372197a3deea3e68125f1a5bfaff56bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fdf6e08e854c1fe00257ef7b559f6562

SHA1
034206a7005152c4e344e1445e5284d0ff3034a5

SHA256
441ce33ac46457706b919d80ad085ce5e5264e7a0adee81e07f516a15baaf55d

SHA512
ef628c8e52dd54854dcdf67ee8c9d7977a904a8ddb0dd801c8e190743c141193aa2258b99dc78a4133bbf2a6c8938b21829e76d0caf0be2d80a2a40b2f102fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
db4195e8138f8fcec9aeee8a3c8df7cf

SHA1
e3e59ccbb7e7f912094a9fcb72d6df5bd10e6e8d

SHA256
b2ecdddcc4532c81a2474412fafccb4f121940fe050de6964c7d27d34da26903

SHA512
625759155994f6c7d0fe8a3558c41be7faa0666d1634bc48c87181f18fb2b9f8d1d71eb5cacf49bc02c898465d9b2954ca764b478811d0d8a3a6cdf092967ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
347f21c30dc19065490f45016cc67eb5

SHA1
9764ed7a8f1fe3582a4a20f782bb345cc6b577bf

SHA256
1f4db2dad1a7ea24f9cdfdbfd6185518977e6165801f9b828661ebee7438ba9d

SHA512
f7c274db8eb263fce00c3a7f9249f0b80c83feaeaaf61bba17e9e117a71ce534a8a4d496f142dbff085c3bceb3367619a7d8a70bed8eb8c19e028929face0375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
97fe088ec844267721c452667fa5089d

SHA1
eb5f737c115b849d0a53ed4bb29fb9958369a696

SHA256
ecc034760f0e0fa29dfe89d52bf022943a7520a511013358d40644e6ac9d4dc3

SHA512
85255809412f2cbf328f080c8f1252d6afca201d5499ba1bba28f1481d2964200ab7c83c1f8a318800137d213a53af2cc4f2809f91bb0db2f87b5c38fc910043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
76d4307f21c5433924cd98494981aace

SHA1
bdc9083e85501f35641143e41fde89abea6d6ccb

SHA256
17e5e2f60df6e30d3f1e8b2276dcbc921cea32bafd7788213c6a5dec701e17e3

SHA512
b67b9564878cee00422f7c635b9b0a996d406f2986a39d99878ce9f3f5b13595d39a854c9b968df5c078fe34272db21e2d4cd37a7d23a0460f8bcb3c2e44ef58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d6c35bacbc993f2dd4b8a95a030b4ab

SHA1
e4eeaf5432ab2011a6434573e109272b0fff195b

SHA256
6b83aca6b0e384c773f4b37a49ddb655d4a37f86d828d6eb1cad35867da2a841

SHA512
2234b343b41e08dded409ae4c3e3120b75b1d391979af8a0336539826218b2d2e37a28c5d6ab239386413ef55ff19bd36c1ea2d9eeaefa447113eb997b4c964e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a2fbc3566afdbc789d249e60eb3dd54f

SHA1
7589d7eeb44f000efade2d706d66a11cf327db1e

SHA256
f247d9e7b440b8d9d0ccd45c711c08bcd95f7a43f5747ef647d7cefab55bc9af

SHA512
7b2cc06870e56867da590a0144274535c5116d91a0d4f0a8586dca154174a73ec2cf1ce7681a856b1e80af9e08d5bcb8cebac97dfe604df3c1dbfb3be19d3117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c582.TMP

Filesize
1KB

MD5
35b726bbd372770d16feeaa1ab4f3715

SHA1
a89f74bc28f8058a7785897c4d50c4fa1eb874e6

SHA256
cf4efa098eaf364747ded4a2ec99fec6d02ffd3d7aa1147a471bc56468c43b75

SHA512
b621ec5c9a2b0f3eef08eb86e9967201b18b3ee3e716805f297167b4609675a041cd68cee814ed8c4e4060b0abd2a095ea1343b075a37991900ec277db5c9d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ad450683969a7cae019db4df545dd1d

SHA1
ad84b4331fb0637abf0a2be3739b21c49701f77f

SHA256
24f93680f9d7b51a196bef5b4415ffa39c3d7dde8eacc5eac68fdff1b7c06c32

SHA512
00090809cb756b646809d5873fb876ae7b56d53251e7fd546c363dbb983e00099162e75b7dd9e0de4cf78dfbc3960d18520cf2d4a158d0766303237c74f48f5b

Download Submit