hxxps://qrco[.]de/bfRtYF

Resubmissions

03/10/2024, 00:18

241003-alvqcsyarb 6

Analysis

max time kernel
192s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qrco.de/bfRtYF

Score

6^/10

discovery

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 2 IoCs

Phishing

T1566

flow	ioc
8	qrco.de
11	qrco.de

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{747FBCA8-D9F9-4BF4-9347-CACD9A8FF0D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2000	msedge.exe
2000	msedge.exe
4036	msedge.exe
4036	msedge.exe
4280	identity_helper.exe
4280	identity_helper.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3932	2000	msedge.exe	83
PID 2000 wrote to memory of 3932	2000	msedge.exe	83
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 1740	2000	msedge.exe	84
PID 2000 wrote to memory of 2900	2000	msedge.exe	85
PID 2000 wrote to memory of 2900	2000	msedge.exe	85
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86
PID 2000 wrote to memory of 2756	2000	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qrco.de/bfRtYF
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b22a46f8,0x7ff8b22a4708,0x7ff8b22a4718
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15506096479266893934,4669978672842402447,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ecd21728afc9dbfe45989c6dc0337c8e

SHA1
217dc20db6033e5a0d773b099a27e61f5ce8da4e

SHA256
fbc3b14f63c50d626c60be68f74d71e360c5a06c4a010f0f4680f895cb923464

SHA512
2a4d5c7f18003c41a9314a75753d148d613c4b673392dfbaf16ab666fec86083d037a624a86b23c44f8ae41cd5f584eeaaeb20edef7e1a7abc56b65b001515de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_stockx.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
69977da3e011b376d5e7568412ef657b

SHA1
e791325cf684795fb2c4157659269bdfc7b4a295

SHA256
6b49fce2784e7f9f2714da6724189143dd2f571747f22722d90a674627c1dfdf

SHA512
628b57edf4468eac8d3b06bd75792be1e74cda19c6c0ae235757776e46a2c4ea24523dc4b33b46ff02ae397edbfa552e555bf9ad726779301f57954f7fa13c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
757a74cfd2b913f75de358daddcbc120

SHA1
26a0a95f655b27a980f5cdeec569f88295474d15

SHA256
798ab115cfdeb22e94e17b712a5c8acaea0b6dd2029163ac5113c382ca20623d

SHA512
31fc53b2ec8972ed03a4cb79088478166b2fcd568ac601169777325cdfe02911e8a4b701506fee53dbf1f0540be87a141ce5577c26f7d9a77d5e9af4241c5139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1410577630f69499b6d0b49b0dc1648c

SHA1
f8e36872d9fddd7aebb3bac9c2fb6f05b72627d1

SHA256
d420c62b670801c7e8c063f9d39dc06547f9b5db41d0b471e2194bdf03aadfa3

SHA512
b49debf0010eb5fcb78a69bde5b654da93a3f049244082477a37ecf8649e68e69a38d0374f04655c3a09010933ac08a21526eec1ddee8b5536895493bd7930e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d03512a52097de49cbd142d1ff8824d3

SHA1
fba8a7b81748203b309f886c48de703aac496003

SHA256
eb3be1b0ffd0ed77671c7705b3332b3be71e394fb9cf3fae0000cc4ba4318c97

SHA512
f893a4cb2f0e0f529379ce1bef0413738d88e5acdd2ae2a527571486495c906a1c5135a0de4450d36ff56e3509558c7be910c6eaf78fc8e0d0fbfbad90efe7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
19d273350d06495950969893edb87537

SHA1
c85a4854a1a315b3c856b827a8ac805f96e61b9b

SHA256
5c89f7fe000c1a03cea7e24c31830e738219a08a13e698197d74979ef345f539

SHA512
1aee250a1f2068e1df311c48991a5db20a1f65f52e362186007b5f33095848494408a355411c9da6d0e955885b01f8a18f73578c6a239057162c15c6c1c82a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1dd9d18a3d7febd630ca1974344551f1

SHA1
7be3d36fafe44a9cdf436fcd0f2a6e395b1842cd

SHA256
b738e7bdbfb1db96607b68b524ceb174614ef175c8c28c2d10ddd02fbe4e9f9f

SHA512
fd53636d379175d9bb5268f4e93c36fba9c597d54fee51e648f8f2290eaf89a95e65d5a7098cb566562bb135116c7500b49a45eb2f62a3889d7db8b92ea7c626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583dee.TMP

Filesize
1KB

MD5
ead65b471e6a3cfca050912c02630685

SHA1
6f7b8cb2965ed805b8e4e75f0eee6d95091fb045

SHA256
442a5b665cdc839dd9c263b8d1b81c5bf34870c8302e5c850ec179d0f8503038

SHA512
ba96c51121f1be683a4566db9bc5b02b160d0bdf1bfaf6320a91259aaab12326a153f783a49aac6949a6473fc5a2770785bd038072042d45b786d9e2481a7dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3ec48880c1ba192bfdc4d4213896759b

SHA1
8f1ee0b9f59c350baa3a261305e1971eb2f1b2d1

SHA256
9a8b0491ee5b4a6fb46658a289041c21b8394edd8bb4b2cae3ea06961baf3ed1

SHA512
2948e2f429977e35711f23945b9a557254aa1ee70321dc0f6b004c0c01e39f0c538d327d39e2d6a5729192b1bbd8992f1754f50337aac6b88c8fbad96f2a017d

Download Submit