hxxp://www[.]customguide[.]com

Analysis

max time kernel
95s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.customguide.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{F9A3578C-27EF-4535-882A-758AF283A993}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
2844	msedge.exe
2844	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
2856	msedge.exe
2856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 3064	2844	msedge.exe	84
PID 2844 wrote to memory of 3064	2844	msedge.exe	84
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4120	2844	msedge.exe	85
PID 2844 wrote to memory of 4140	2844	msedge.exe	86
PID 2844 wrote to memory of 4140	2844	msedge.exe	86
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87
PID 2844 wrote to memory of 4960	2844	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.customguide.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9feca46f8,0x7ff9feca4708,0x7ff9feca4718
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7092721754779206615,5076388653476648876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b14c207-a1a4-4be2-b5d6-b38aaba88fe4.tmp

Filesize
6KB

MD5
aec3bf3181cc2ba44953cece38923ee5

SHA1
618999b9b1c15502e3e2c6c937fafceea29f7356

SHA256
70e7a0a92f379421ec2db39db33d12bef75a7286d9b8d1ccb3938f2dac71aff9

SHA512
cf9e0150338635f65c592c56f3130607563503fd5f89c3d68f07775c4432cf9cfedfaa916fe328d35842a8114752aba732d726c5bfa723deb3d3ed89d46f709e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
be960148f64dea611fe3346f539f9234

SHA1
f3b581cd2fc37119627abdcdf4181393455ab393

SHA256
f67b9f1b27357423d4e25b9213da589a0aca491efb448e51aff03cbbfd04f50f

SHA512
5dbd0798e74854d20880dea3e6a9a6458ac03fe19fdd3418988f15b274e83f3bae05f9045d362924eea7711c7e6f86d735d3d471d0bdbeee5bc757c4dcb168dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5ad468ffb88ab885ae930e52820db1e7

SHA1
3b81143d994dfe10ff620a0031d4e1db4da6822f

SHA256
76a68a19261b04d56513b2771bd174ed09d3a445f29f24b0917fe12d96f1abc0

SHA512
e232628375678619b9d8f96c497d7a342b866a1b4c314154008a0e85472c6d9e532b18c637bc78b59ba9cfa8d2971ea211c991087087d0c8967abadd149b6222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb75c8db6ef1f1934213a4e21d5ac278

SHA1
667a83e3e381961984d067fe48deeddb3165c0ba

SHA256
e8dd8854853ee6c97d0ff38987615f723a3856baabefd917896dc912bc7c27b7

SHA512
b9369ade8d2569d571bb6f8d6d341197c9200abfbae5bc2c4d2ee86f1253c6e59d2f74e5b7b35e2bcd430998d7215f4c6acc7eb6d24261714a672604a99bc8b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85aa2603b63908ed8d117efd304c22f4

SHA1
b1a1a3cce35112de181d2a425af99bf84b579ed4

SHA256
fc69badf238bd70b1b1a480e606e7f5da2f0745a81ea9b903b28a270f1f05a72

SHA512
efc5f628330ef5c7882f257223d311b94435d7660ab0c0f9004aa882fbb025f2ea62f03f880fd366c0a373d09c662490c85edbb6c1daf927b1c3f801c49b3cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7cdc668b4d28ca9c1cc1fea3e05c6994

SHA1
20be7c78a57e8dc81f0f37745a4ab9b50771ca9a

SHA256
f695660a277a5baec1abdc77ece1a2f02b48401db07efd41574b3d15f5736a68

SHA512
8fa4c82cd0ae42d6f6fcca21af123bb8e025b6b23a93c35ef495eb25e64714c58d64d097b1125e01e148bcb8813b9a446c75c605c8957069e8b9a5fbacc047bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9053099d42dfc3e7e38fe3554527ad5a

SHA1
6062f07933c2b414ca5694257b38e80e41085619

SHA256
a851a5ece9874652ab1415850bdc2118ac6dfbc2cca3952480903a56ea64f2d6

SHA512
d4355fc5ccbc1c595958ca819737fa30d11e8d896f7ebada8c35bafc8e253581daa45870de12aa61a9538ba2d3cbc616097dfa0c513f7f7f43fd83d731e29ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6bda9e848e3de5a6b7e86af19ea98e21

SHA1
7b57332ab772fdb04647a2ae61a93cc08f83ca43

SHA256
aa8e566c29573936406d108da4d77c6ed241becaecb01a0ada107fc64fa2ea4e

SHA512
8e16333e10d4f19a2544d496e319f9ff9fdbcd53f31589cf92c6ed943f78f4f9bdb9439ce9e1312bf23b3849f839c0e335926e29b5a7b707b2bfbbc98cc496fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583b4f.TMP

Filesize
706B

MD5
a1069c64ae62ce108f23d4e467e45476

SHA1
affeaa8c9827d4654c783f2b969b5c945ab1db00

SHA256
c9d2687f72b65501a55ec95a762fbab3c226255afc25ff467cb91632fe7a31f7

SHA512
2f6681c36a60a5fff0cbb6348a5ba1cc35897623d6b3f1b0b2bb62fbbc4d64be3b6e9cb4f8c548741f633199c05c69e9b03501f48a659c996120c529daab0555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50c69fffa503d51eb95bf74d57a51b0e

SHA1
b33b0abac21631c1be74d3e3ef5f0f1fa267422c

SHA256
df5938b2c2bba2d54290f063438b495ee9668e4c06522dbd18e87f30c593ae65

SHA512
ef89cdfbd3d65b296cad8e4197d5c6714e551f434b5cd811a2904d66f24d688395e72b5fd1643dc08c27f21577f73893c2db928dfe3aa2026fa42ae4b9128371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9fe763c83ecf4056399885de4faf10a

SHA1
08b6888982fb8b507ea7e29d9277fea7c193bab6

SHA256
2aa0ba4a6e09e367abae3d9c494aa6d8adafb2fbe743d14b78716424751ba175

SHA512
0d0563924a9ab4df158fe0fc1a5bd71be9e97d87cf3b8f5e72961c22a1b5bd1a5b27828b428ad19462d35d9148f562bbe3ae7219ce0c8fc08dabce9612a64c46

Download Submit