hxxps://new[.]express[.]adobe[.]com/webpage/tAVx4pkCcW7Nu

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://new.express.adobe.com/webpage/tAVx4pkCcW7Nu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
4364	msedge.exe
4364	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4288	4364	msedge.exe	84
PID 4364 wrote to memory of 4288	4364	msedge.exe	84
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 2128	4364	msedge.exe	85
PID 4364 wrote to memory of 3676	4364	msedge.exe	86
PID 4364 wrote to memory of 3676	4364	msedge.exe	86
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87
PID 4364 wrote to memory of 4308	4364	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://new.express.adobe.com/webpage/tAVx4pkCcW7Nu
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5a4846f8,0x7ffb5a484708,0x7ffb5a484718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10302741293856278433,1259635741047818970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
3668c102e04d621d84a0f1122fd1332c

SHA1
c10251e7c9cd1eb897f0f780e7c88bf532f60537

SHA256
28e566447a5800121bba1ec4e423cd62da806ea5bd1b746459f791f85ba5327e

SHA512
5de2356b6bea83f8b208c2d7b3b13cdae0fd090216783b2ae8edc6ee9e1029e4ccfe1c161bacf7b4f8232ef5ab53b245ec35b50e98b239ca2df47ee553be9524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f645fe2b2a1e63ef3f94f5dc6ae21b51

SHA1
20d2a061216e2db847544a84104a227de5a3e2ac

SHA256
e8ba751fc12cb49220412fe26ffd3d30e6bcb891cb4f74f8b28b3fecb4a515ae

SHA512
1cc11214d20f892549ff2cc556eb3fd3a40d7528d02a5eda51ac49b59e792ff813f31f5882fd8355ee162e812da89ea5ec7f1da0be5d378f06543f2b031a7779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
700B

MD5
d868cffc936d44c269e24e2174d9f2c6

SHA1
872e9c7dfda66a424a7d68fcc02223defb8d0e35

SHA256
b4b90889cf135fe6a87520bfe12cb6c17ce6b010362bb40fb95b3c95dc257cbe

SHA512
de37b8e3d06aef30f863699e9a07c1ffd15a9e44bd16d6fe5d4bb0fc07cf4daa8c5d98dd549e1629203df77eb0e757f59e06ea0ab326f537be42926c9d4f0f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
989B

MD5
491d59a26b4ec09b1c75d802e2e01e2b

SHA1
de3e29f615f9e1b450748e32ba3da5e88bb2f5e7

SHA256
3a37bf0486d26b77165958454cb1165f5752c9115c926393ff22e976eeff1b28

SHA512
68bf740fd5e0d6835dbb9cec72065577bf70b359c1d9bf0f0a4c70acf8f9c3a298d3f498d929ef6258ab3a93f03fa723981931ecb72b7db45f5ccae6a0ced45a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bfd2050a38496153d5b5b6e1c0a3a259

SHA1
54a2d7a5a01658ae7348e6338e950712e009b66c

SHA256
e590cfbc862e779e369318acb2aa88719f2b331c49a1d93897504773bb462ecf

SHA512
8c169d191c9829cdd9ac4dcb31d55cfca9b246bef9218eaf939c987f836ffc724171bb71362acfe9fa337d80b4f9c300d3b415d88f223a9663a21b034de4cdd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
735e7293a987400a7bc5bdc3159c3dcd

SHA1
c587ffbed3c1185a265c579c833a6284165c1c8a

SHA256
79f7e242561bc65ef33fccaee448761693ed66b48c908b20ada1c1bd6f613c53

SHA512
b94ff48dc509854b3f42975cb7a53372750b63eb8c9c77ead49f4baf90ace38a5940c8793f7cd2e3255a9e8b04dad11ffe954da5363ac74a16bf950463aa31a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4197e7ba21d5a2bca7b024491582204

SHA1
c5e2f25018627ac4060582537e8dc4422380c0fd

SHA256
5f2fa32b0bfe7b60b66ff777b2a4f6af8a56548f9ea32e1fb16cc1fc265e4cdd

SHA512
86628e75f9f055976fb6c7e493c5740a30f7a5780e48a2d7d24dde18cfeb673c4ca1bb88b5662d5e2eda183cafe1a749cdb0754eeae5b0b74d4a1fb0aec6cb67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2513ff085e990800e17f37923c4af69f

SHA1
6b2031c94c72056f89db9959f5eb788659543d92

SHA256
ab7d848e56b0eb802bda3d5fd6e25153aee7723cae883d74d47afb168173d9ed

SHA512
6132bd265169a13deb6ecf93537c6cf64565bdf229f446aa77e4ec11a7cdf391e84b8bea33133523688e8b5007362bf9ef3969d4a9656f2dc81900012f0fa5b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d35096fd6c957d7de4084e28af478e24

SHA1
ddc8e6d6472467133e53560e680ae75b0c68bc90

SHA256
d5b413e12a5ad69e028416d7966da7edf787477859712fc100cf0d034f79ea16

SHA512
95860651228910cb40cc057663a7b360c2ef01d6cc5cedda78673493053f2adf634c72d282af35289621cddf6bbae0c012a5b97d983ffdc9296ff271f58f8df3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b9c9b8eea07fe9b252c32ba8e9effd0

SHA1
e3d0eb709d9a91b41ade7658907f16de93ef298c

SHA256
330ac8329037d58a467df6c512cb23932a09832f22553afe6ee7f91fc3e120ed

SHA512
25070392d26389eebbcbfe988c857269ceb25d06542ca32197b34dd52104567ddb5ed44e5fa5ff84dbb70d5eccc7bbf95cd0616c36536cea4ee41a147ae1d51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8e6ae33592f4c1d79e4469377c1f6e7a

SHA1
f965aa0ab9b49e69192692a5e853ba3c7ca2904e

SHA256
0fc334d9d60cf76b8bdba98b07b519110e3aa4caa0b99de28278549c4f984100

SHA512
c3f2afef09cbfbfd82d71417a0f2fdca71f390bbbdd26cfff674d5c38b1d120f26bec4e249f92d4e48b21e29be7b0407017a6d3d430711b6ebb9ef800c5dbeff

Download Submit