hxxps://mhvidp-prod[.]myhealth[.]va[.]gov/html/js/editor/fckeditor/editor/filemanager/browser/default/browser[.]html?Connector=hxxps://gen55go[.]buzz/extra17/?id=free-vbucks-code-working-C908118[.]php

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://mhvidp-prod.myhealth.va.gov/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://gen55go.buzz/extra17/?id=free-vbucks-code-working-C908118.php

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
240	msedge.exe
240	msedge.exe
4364	msedge.exe
4364	msedge.exe
4764	msedge.exe
4764	msedge.exe
4868	identity_helper.exe
4868	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 2216	4364	msedge.exe	81
PID 4364 wrote to memory of 2216	4364	msedge.exe	81
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 4676	4364	msedge.exe	82
PID 4364 wrote to memory of 240	4364	msedge.exe	83
PID 4364 wrote to memory of 240	4364	msedge.exe	83
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84
PID 4364 wrote to memory of 4680	4364	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mhvidp-prod.myhealth.va.gov/html/js/editor/fckeditor/editor/filemanager/browser/default/browser.html?Connector=https://gen55go.buzz/extra17/?id=free-vbucks-code-working-C908118.php
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc369a3cb8,0x7ffc369a3cc8,0x7ffc369a3cd8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7588036764534647956,11550148151174578825,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
28KB

MD5
f58c3820c959c55ef7d8bd2d994535c0

SHA1
09174539bdfeb88268b3bb65d10bf137373adfeb

SHA256
2368bd8ac8f220d0bd69e8d9ac1e8dc4d4018bca9c53b681686fde5763c86bf3

SHA512
8ce25ea67bd9390a045e2370bb3702296dd865c8b07f6379f14de94c0081b059e5184183171561fbd6224164554da75420e6f0788368fac53fdc35136f3a143b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
9ec1d15b5f308bad469ffe7e4fbdee69

SHA1
c48cac3a4d2904e6901a5b4569e591c2308315f5

SHA256
0ae93f71bfeb93f7cde0a83c635e92a799c151d0c50742a3ba77d1cd392cef18

SHA512
a6b5cde510a712be805ce3929b927e3273ec0b85552b4afe8d08a2aaa0bcae4737b9d35057bb76ad09de5c8183a137767da075ee4904a82c5e876602c3bb174e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4d27d6d4ca18d1f29246460c7887519a

SHA1
dc9248e64e4c286589dab9c961aa3bc62e67a8ef

SHA256
4cf06c45badbcf79fedb019362f2a7896ba6f71aefe73c086237078a2ce274e4

SHA512
a40035ed7eed0513ffc70bd6afc143999eb34972998e59e47291692975af8e0fd80f31c6c7ade0ccc329ad06284438ce81775bcb4dd3669db2e440769a219c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
68575fd213ae7836a27a66f81955e873

SHA1
979464f8fe77d5ba1dee0c72cbdf436a026c2d86

SHA256
dd7efa97d2be80e5dc0fb469a70583516dff6e4dad150615fb11fa9dbb75f145

SHA512
60cab80dbebd400235c75791ef04080c2384ce8c257d980c42a6c8fa72a0e4f797ab04dde86b4c12228b782b623ff9bf2f5a27cce44902904b49bdf3ed0ba04f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6859f58d7fb7cf204382b5dc049f31b

SHA1
6bebe22c7318a106c7c2ff6e5fb82d7e9b4b04e9

SHA256
7f00eee6c89cf3393be77c38d2eb8a843c6cfac3451a1c916bb423dbbe58d4af

SHA512
a0871f618b670b7e96832e3b20d64fb9feda09d7d939931c1a2577343e9dc50e4d581391c5d34bdc8a1f006a61641b180185d3e5bb5523792ba4c662718591e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9f3183dca30d2cb0e7365d121b10aba

SHA1
2c040960ef30c44f81c345c76d6703efee700fe1

SHA256
4da1318745744ca69c9c0f634fa0fcb0b02f1a74fc27e25bf511ae78ba6c0c0c

SHA512
a03e9945360e3046e870bee957774d8a22fd83bf8219feb234c2e499114f42ec7873b75551c679a423c69bc90f63ae5870846898a1c2540d4122ce4f22e39eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9d6360d3d4c9c2d5ee6558434122963

SHA1
5c9b8d23b7796b6d5d4be11366f32b239168d4bb

SHA256
0a60804d38e3100e610f501d0df6fab03e5504766aa6faa83662478ccfed05ff

SHA512
f7415c3f4a919a1dd7d268f94030095d89a6a7dd7e2f8482d8509d32d6eddb4e3a9f50a7ad6fd791462cac4333b37594a94d4a3a163c9f85486962f814181ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
73db13858dc7636dd64b03f59127ef28

SHA1
8c1144f0e6dc8ce2730b13df348afc07c4a4634d

SHA256
fe9696c3b50a13fb59eaf8ddd16cb5fc2c00947c26a051bf5fbb10378ccacf84

SHA512
a1f4269a2f1d4fded8bdf476f86f848d06cd559ebc25f16aacba276f3042d70815234c0b9d88d7d4a135a231f54e398aaedb4fb0101fdf06eb4b9f53352b0086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3714dfd6aaf519ba1db6b156979fa4a9

SHA1
b128fda40d34dc1fe241e2cd96ae798a6113f669

SHA256
7e2bf333bbc2d3f3a54ea192b64c2e95f8d00eaf139053a9805405b9297ba0cf

SHA512
146186e3c206d871f9e109c1f73e8171c9bd2ced10d9291d3592442d033a2299bbc2604880636bcef230beb0c941dc251b6c56c5c8976ebcd8ee673ac1e2979f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5805f6.TMP

Filesize
872B

MD5
8732cb8b89c7991f65bca1e87546da64

SHA1
3d18bc730b878077e53ed97c81784a9d1df54c39

SHA256
67e6e007a13f04bb185380edf4d5e87126f5a0326a91addae1a59f1a6993994f

SHA512
146aeeae5d7622b9b771d7c7f2a0d84a8f0166a6efa5ba8adeee8dc6d04b1bc316540cf4f0306121e077312b7987a8cfee22de45ee4d4cfeac1091e6907ab26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1ab0d8622e256dc6b8351590ef6cf481

SHA1
9ce584d0b5927529d2ce6da1f95684786659e54f

SHA256
3043b89cc6576ad7059ef9b5dc088bc3669fbcfd93e5012f39bd7851430cab4b

SHA512
84e69d93194e18981748a5fd57745db02447c6de7f17dbd44dd83a5cabe2b47a982f3d411ef9661c0aeb49797b7a217b8b61e22ae2ffb1fc70af2923d399f382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8963049146244be776b9cca3f8205bba

SHA1
1aa1a90e9751471d4b6bdd12e94ecb2535ff75e2

SHA256
1cde373b385f8f63cd511b39901ccc7ca0ef20d57e0eb55ba15a01f79f1d4823

SHA512
6353571afe804ce2304fa32c1013086a07cc5980b42d7a7a1191df6d5788e634fefe589ff87e2b7f1a39b7fdd89b1901aa079239a8bf88f100cfacd4f58fec8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a14f21384d806c653c77f89fa12c8862

SHA1
c14995b9e2b4267394b303df47d37a8461d7f5d0

SHA256
d1a978c829cacd312e49f05998f3bff20cd18ca3808ca4e55ea4693bb41d9823

SHA512
2830130a08ebbe316c468a8ab93dc18376f29a830b46e8eab88b5b9d5a636edc532b8d3154f77311beaee56f7788f47c10bd7bcf7367757c2611589b89ce17d8

Download Submit