hxxps://ola2[.]performancematters[.]com/ola/ola[.]jsp?clientCode=flpasco

Analysis

max time kernel
291s
max time network
296s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-10-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ola2.performancematters.com/ola/ola.jsp?clientCode=flpasco

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f2b9d479-b5d7-454d-9239-7b39a05af26e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241031144536.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
2968	msedge.exe
2968	msedge.exe
1320	identity_helper.exe
1320	identity_helper.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3568	2968	msedge.exe	81
PID 2968 wrote to memory of 3568	2968	msedge.exe	81
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 2964	2968	msedge.exe	82
PID 2968 wrote to memory of 4048	2968	msedge.exe	83
PID 2968 wrote to memory of 4048	2968	msedge.exe	83
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84
PID 2968 wrote to memory of 1212	2968	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ola2.performancematters.com/ola/ola.jsp?clientCode=flpasco
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffa8b9b46f8,0x7ffa8b9b4708,0x7ffa8b9b4718
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff7ab9d5460,0x7ff7ab9d5470,0x7ff7ab9d5480
    3⤵
    PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2280987767172026880,5055374705268632255,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x440 0x4bc
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
336032777f1adb61ec2acb402cc4269d

SHA1
a0af0a4bd828c01889eec9b17f935a50ea3a7b15

SHA256
96d4a32a16740f50683fa8b9b198b2f3f4704e1a0bcdd39c14117d623c64993c

SHA512
17716ddb20504d3307d3b8077c968fee0236783ed9bc0149567a475a7da5c5941cbd5c256c116e98e93f1196b0b53bf9d599dad35ced8d16a9e04c48c7f50368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
820a973266b06dd98eafcb3015583a04

SHA1
25ac703528c59b6a488d6d3763bdcd60305f78d4

SHA256
7c6c7d8958c5bd2d61bbac11262bac45483c4b04c051115e7fbed6fcfbcd5ed3

SHA512
e6a6223e729b0642a63231421af88ac4245fd8e7d40d9b2aecd7a07871f8e088d40cb13975c9d42194e0ba6861f8fc286b52d066f89b087070c6726422b5895b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
822B

MD5
a3bb33f52820f72941f56bc85b29c7bc

SHA1
a9c43f468c9902b32c10146c5c79f024bf20998c

SHA256
eb0dde0d56384e453dbc9585384ec0cf3293915e2a0e22aa83e1bb1256a97857

SHA512
a20b16579125b37f2158ce50732dab9f02721deb9b88dea6d92389d4795041cf72c3b202346bb79266d82739cc02301c0cfe2e6706141826c7ed9ed1fa8b800d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe57db7b.TMP

Filesize
59B

MD5
78bfcecb05ed1904edce3b60cb5c7e62

SHA1
bf77a7461de9d41d12aa88fba056ba758793d9ce

SHA256
c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

SHA512
2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f94b1621e684056bcb3e87acb3c4e669

SHA1
16acddfa3c7a18050af784b3261a881806a7e55f

SHA256
e0a3fb1574907b0fad599f6b63256cd6a9637b29db1731b51e828a546160702d

SHA512
dc77271513b1abaa2facc29e9731a0b3043f5ad2a6a996c3a749c44d1af0540fe318b9d32ed480100d0e8142d2a9593c7c72798f9a6770ac7eb21acacd19c369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f9609d34e333472ae68ee037c02f122

SHA1
73f798df41cca3bf424261defe74bebddf28c8a6

SHA256
166b6507e95532a733772908cc22d75ded79e19a12fe90277243afbc72cd4c85

SHA512
ea82287ad2c8f1d6622d3c01c3c72762b934282e94ad4ca5a28156c16df134433bcde131de5c589f43d2c4ef2bda0e2616847f50bb0541277fb9870442d9aedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63dd1887390bc2964494112633be15c4

SHA1
07ea6ae74385eaac140e4c00fec0499774e54d54

SHA256
8e43b355031580a8f1f382cce26daef54c38b1aebbc9ac7546d99bf53202025c

SHA512
d18f4f9b7e56310671b8088c5cba613557ad1a36f47618421b3f382dc6643a4d897b59f73b12b73271a5e78f1ce6d3a08cf964e548501df203245d3d31c2080c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0536f54-a37a-4a7d-a96f-ffe628cff3d0.tmp

Filesize
8KB

MD5
7d33f038f6813d4452ea702b8d5311e5

SHA1
bf88ec517244731c6c20ed93969ed3bb35cd83c2

SHA256
cafecbf7b8444764c384e7998684830a74d493b5e107a32a432d5f02908d0473

SHA512
4af6be8d10dd4d9b2d8e628975ccf93de06d06b21b4026a0fb55208d5cf706501f7c4ddbb0500ef345c3055430539c364c2583425c1f1dc1b70101decbde99b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e7c8ef7c20ac7176b8568ce5414807f4

SHA1
eee9ddbf7e73cb985cb0d8ac520f36ffbf53a251

SHA256
2d481bcfffdcce7eea2ddb97cac6ca0108c6b2e21241b2af5fac9b23b501194d

SHA512
16486b7b2b4aa544aefba6e9d6328357e8ba689aae9a430165d5365938aa24e44cd88a59bc7686cff16b7537fd686cef8e7f4c74018171b7a87d80d32a3c6486

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b6e82d1f210a1a94d27d5c5580c9d164

SHA1
0e45592a279972c58ab7ec1c3896c6b8b345257c

SHA256
ba0e49a797d73766ccf9eeabd3ac61e73f8636c83f70731b22fb6c565861b55e

SHA512
fa07726e3b8cc846105bc8a560411dcfb697267a547a26d4c793190474dd252f1b39fd6b010226c138fbca09a7cdcb5b40d8104f73b6cc4bd2f6141e27986f4b

Download Submit