hxxps://survey[.]edentify[.]com[.]au/surveys/mintro?fid=65d354k4&sett=146d1ukn3&cid=2720&did=3n43r6du4nk3

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://survey.edentify.com.au/surveys/mintro?fid=65d354k4&sett=146d1ukn3&cid=2720&did=3n43r6du4nk3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4236	msedge.exe
4236	msedge.exe
1160	msedge.exe
2432	identity_helper.exe
2432	identity_helper.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4960	4236	msedge.exe	84
PID 4236 wrote to memory of 4960	4236	msedge.exe	84
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 3460	4236	msedge.exe	85
PID 4236 wrote to memory of 4408	4236	msedge.exe	86
PID 4236 wrote to memory of 4408	4236	msedge.exe	86
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87
PID 4236 wrote to memory of 1008	4236	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://survey.edentify.com.au/surveys/mintro?fid=65d354k4&sett=146d1ukn3&cid=2720&did=3n43r6du4nk3
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a90f46f8,0x7ff9a90f4708,0x7ff9a90f4718
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,342721571281128025,15275690236151597534,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\78363edb-b4e0-492c-ba8c-266afb456175.tmp

Filesize
11KB

MD5
fa14e5e59dac453d320cde736c18a93d

SHA1
f0d3450f399209e4d86960bea291a99155c19a8f

SHA256
d200c572f03227010abde4133073d568d7504622f0a9652cd860f9c1de750278

SHA512
ac57d8bd55c6525a6484a5cedad092f9d2db9d4a89f2d1a40a9b1b74c0f05ce567003bb03bcf6e038fe11c95c89893021d840bf2ccffabf6294544048f596dc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
42KB

MD5
32fe19a1124c761e34672133c9286dc4

SHA1
71bb41ee04f2e3c6b0bc26ebc5653c77fa9a92cf

SHA256
27482958b51aebf24dfe9bb27533a96190142612d8bd9f0c3d78dd887f06c035

SHA512
78521fefea6f57953bff9e306d95b13ed46f2e4bc5a003ec66f80e14f2495c307149a76663b0ac170166d37fb774c050add7fa12103e66956157b64fc8e99463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
f0eba7668cc518f12a683973ea1d4fa3

SHA1
c7af7578fdd0ca0027715cf5e44cebfc63d24f5c

SHA256
aaf2a631e7e5bae16fef921cd538fb63e9ff5a62e3a5bb5cf3f764321c60e824

SHA512
f2b030f016a6fef9c4251191d8e77ad22dd6b9378032cacc6d78f0d45a148c64053c8416716fbc8413025899139c07cf05f02a1b8a52838c5123282b7c787f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
936B

MD5
c3103e99a32c7aa35a26fe4635141291

SHA1
04175f2a15ef94e38b11df217dba5862012daf20

SHA256
ef408f34b0a8538f5341970744d5fa66ed4ba1174fe78b717eb20cbbfa50456b

SHA512
0e9b84d8525c7539bb29e3bced87062db56d0f4677e2ee71c0d4e0d671d088b779cad1eb039864dec6bb506689034f23dca27e06c2139578aba937e52c719d62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77df5614a461ffe002a927b01c6ae4e2

SHA1
b548d28ec2b119e14751289e9ee5fa15c6616dad

SHA256
7ac013ad25800adb3ba43b17f901e406e4770d9a05ce8c304439e7c41786ef31

SHA512
86a6ddf15ccb6fa90277cf7c11f74fbca6ad5fa2351dd80d912dc6458b28e683624e5ba3e3d74e0e24d21c935bbd681e55d1c24e55cbabbb93fb3013fa6c6d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1acb6a65faed876ce4a9e617ea93885c

SHA1
6c3a728fb09230f1bc57a3ac83675a25744ee5fc

SHA256
205c22f1c9a7ed70926f2ec56fb82baa023cf88f4bc48035ef4d53e64308926a

SHA512
182eadaee8b506e03e83dc42c3020e1ec16eb4d304bb9076acb23b639d75ac99c7e146b1bbfe815f162b58d9bf4b3be012903db32ab0428ff3bc7892c0f90dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb38f29c36029df1f18dac95349b9402

SHA1
5d457893ec2373b44c81cfe292ea835940df59d6

SHA256
699b4c92f3ddd93924d0c25e2b62a7ad409f138ab1e0f24a40d38e9a6fe3af00

SHA512
c5f225ac31407255584007dba7bae6d8cd5d4080e1ed22668d231be5b3e4d9a73eadb78b7c06a936d7ca04e1cb5852c1c58e94a61485d82fb9fcf2eafbe6077a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ded2823fa4cdf8e1f23ef71bc52f4c9

SHA1
d9a24bad527e16d191a15dcc634bc3f8334cf0f5

SHA256
fe218b7ad8802575572a78124200802c41e41a2f99d972e822f253d03b34c68c

SHA512
f90361d7dccbbd4351a0bfa321688f1c492f56f4b338757233c91f11df94726e6f775f4ea852d5540883c2e7489268000881bec0ffb2eccf7fd0f91fb2877fe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit