hxxps://kekma[.]net/

Analysis

max time kernel
1184s
max time network
1158s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/09/2024, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://kekma.net/

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	3	https://kekma.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8be96bc88f3d3866	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
2280	msedge.exe
2280	msedge.exe
2828	identity_helper.exe
2828	identity_helper.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1756	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3116	1964	msedge.exe	80
PID 1964 wrote to memory of 3116	1964	msedge.exe	80
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 4904	1964	msedge.exe	82
PID 1964 wrote to memory of 784	1964	msedge.exe	83
PID 1964 wrote to memory of 784	1964	msedge.exe	83
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84
PID 1964 wrote to memory of 5108	1964	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kekma.net/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff959603cb8,0x7ff959603cc8,0x7ff959603cd8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,16992193150451078828,17551323116343275843,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
510KB

MD5
ade9e855c6321aab0aa49e017bcc11d4

SHA1
e7f3449de1dc8a513e4c180a0190cad91d8522b3

SHA256
47ac207e2dcb5127750fe7017d68a4ea9d7618aa44b0faf733aebbc198b40ba4

SHA512
72a9aa2607c326194f9d8ba3b8807ce60d819fddb51f321bc398b9bf4b5e4dc472543fb10cab8226b6352e394dea0ac3ea5d5baf03178006135aa8341aefa913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f511d2cec9ef9e442df536db2f0acea1

SHA1
3872a4b468a8b3c7fc359160550b794979c76349

SHA256
a98eb331931b095e3113a5d9944ad337cb77f9a00001ead25446bf2eca168358

SHA512
03f01c2a55c48d981ddd3c6d8131e08071e8070a3eec766584cf4a2161e0ffb7b4a1eeae2c5c42e80cde330689e3b95ba497e1c79b3bece555e34504f24be1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
622B

MD5
d3ae54f678b0fb6315aaf4c9f901a5ac

SHA1
8445bed534abc9be07f6e94df8e0527936d073ec

SHA256
4e6eaebf7078c0e129a4fbae3b506e4186b808c0bf2153f14988201baa170528

SHA512
1720bdcca6c46fa8f911735954dfbcc0db9a2527e52f5817d1055cd24c44d4caf4d2952970ab500fe9f863a1a897ccbab2f204b59b30cd11787a76608c1cb50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
622B

MD5
2e0a769d169a110932fb9796a588878a

SHA1
bb9fc43a3edc2de4af9e75ba7132a2688639afeb

SHA256
333a899beebc9a164f3f7f4b4ffc3b0d4f46c05f954ccd4379a178eeb731f21c

SHA512
eb3b13d778a12c2569aa97527784f2f1cbfb7734c3da3a65902b99735b7652a838c93bd9087b2c33da83a4f588c0e4cce503a745cc23acba223a6fd6598a117c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03c986d09a6dba5348bf23aeff2102ee

SHA1
c7805773dc1edf0c7b357976fcd95c99722719e0

SHA256
18231883d0810d7550e73119712add46de21ef1c7ee34de51f73c5b906b204c8

SHA512
a8b2e56040af12ebf6b574b3a3103a1d83c57d872c6defb86340bf5c0a6f4b24fd222621e6527fff93e92da86d29fa0ba3eed73a1a5d3aa4d96db066731de1e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e03042bf928ae05a20e633accd21b4c

SHA1
298a5c01aca895b4246722c3a0745fbbbba80f77

SHA256
e1aad9e3867a1aab41e321383bcced8ef54151dd61a45f94bb682ec026ae6247

SHA512
15539b5325bf2ad8c5ac0f72310d15804ff72355b19e34b533b7bee13b0e5b8fd189dffb97f9436696efe525f4eca66b242375951772030cdc270c2de89184d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
30ac81caa58018e4c229edbdf2d0eeac

SHA1
9ba6b9b4b80c309dfb50d32776d9ffc123fb5a5e

SHA256
6f9b6381859d58c97af07341bc5a46fcb89b5fbff4e7f1d2407c9767716363b8

SHA512
b0179b77ec0fe0aa9dfddbe09921089b1e7b9e1b8b95bf5ce23798cdb80e8c613dcab56d6f5c25f2cd8caeca5b51c40646693e57f1e851fc09cb03d09d42757e

Download Submit