hxxps://4c20a669[.]820c6be6b16a6e9d7286f143[.]workers[.]dev?qrc=befordmontrose-env[.]com

Analysis

max time kernel
1781s
max time network
1777s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-12-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://4c20a669.820c6be6b16a6e9d7286f143.workers.dev?qrc=befordmontrose-env.com

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
396	msedge.exe
396	msedge.exe
2152	msedge.exe
2152	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3628	396	msedge.exe	77
PID 396 wrote to memory of 3628	396	msedge.exe	77
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 2644	396	msedge.exe	78
PID 396 wrote to memory of 4580	396	msedge.exe	79
PID 396 wrote to memory of 4580	396	msedge.exe	79
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80
PID 396 wrote to memory of 2412	396	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://4c20a669.820c6be6b16a6e9d7286f143.workers.dev?qrc=befordmontrose-env.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff852913cb8,0x7ff852913cc8,0x7ff852913cd8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12626325102549165761,7046581226628111724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28521642-c93a-46fb-9a14-af316516dc46.tmp

Filesize
10KB

MD5
023571ce01b9f9e821d4ccd002fa883a

SHA1
bd5cc94525c50acb29c5d592d147fdb02cbd8f24

SHA256
dfca7abba13f7d5872e53a9f7c20f5a545b3d98220bd2665dcdf6bcc69c10d20

SHA512
bd6720d0925aaa0fa110b12b8a9d847ceb4c3c031b81a405993a105dd728cf26f60edf30af756c78415603c17ab3a3c15d63042ed39159afddd247b8ff9be766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
7b4f430d491f2bacdf9d57eefa1fd052

SHA1
5d190647434f3262c0c60fe05ec604e4db149ca7

SHA256
cff73585e1d7a543236b6a8c8f1d9aa6b07fc32ac384c21440bb0479962f00df

SHA512
c17bb263bfa85847addafb013b944ea6cab67fe3a784c80a177f5862636a689478967616d4ed7b5de783bfdd8c77997bd0e4fec3bc22098e468b17a62a230909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f9ba7f06d4dd4530eeb591feb513e0c1

SHA1
b8cc3cd2a21b47547fd699f8298b2ac44af8a001

SHA256
0fe6a7f1ee273df166df28b928f44e3254b849b3cb7ffbb812250f4f80794a2a

SHA512
02da9298236da3a27fae6be84e1b18749d346430fb57fb0031eb0f858d58020555a74a59b504741c2aabc9c5be97ce770316ecc5e046d87dcc60b69f00d804c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
698B

MD5
c241073ae749c39be202a25bb3faad3b

SHA1
fbc504d9c37a34ecc022b21bb8c529307008f288

SHA256
b4d9e676b4c3f92029a6e68b1c5f958c0c9f9e124211c6c6378056c88c7d612c

SHA512
1b4ab64e9293f396682780da27d04c7b0c08c416a8c6944374c84e6b06c0e31716353220ec51b8e485b69ecbc0ae3010e5934e66fbd4173702b3a4a266be1b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
976B

MD5
7e73ad3720041c2cb1a774c1ae41b5eb

SHA1
8562267f0590458aad24b1c5c87fe3bc6ce1fe16

SHA256
75bd9e61b101d6ee66ae0e8bad24b90dc9c1fedcd3671e131b5670cafef2cea6

SHA512
4e7eb447c391ea5800b9538df9efac3da7b2a67c9527edc89374ad76b47d900b5d69eb4a6ea98b59c73430a5dcff8af10360eba1264bdc10503b0b31565aeb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ebd191e82e9155bb9fca9f3d1167f10

SHA1
648cf61e1d814530295a31e8e62512129c9939f8

SHA256
5e08cf0a3897d151b2716a125c23793e7322c98070e2ba594cb20e657026bde0

SHA512
041705d7718651c83d7639c3372e4de9e718396a33eb55127ca004e109a0d127f41f174bc17ca3bcdffe5c888b89ca5b93bc02dcbc1c07aa62acabd633dda8e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0ac8a1c6c7d5ecf5756f9d40eedac96

SHA1
62e9785fb941f1ea4e6167253b74640aa8adbaa9

SHA256
7939b00ee5e4bf80b0beda5e3a4f489e144f9179860cc46ed36a6603a098ba8e

SHA512
df166980b84b7ca5e79eae26a7c74de735803f19701596c6be878178205982f5067376d10489bb0fa4e84d6423a18cbe3fef1292c5bb369de10f8e02fd390b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb546930a06adbbb41671b2819372098

SHA1
8f74bf60ceb2aa15b8a666e96e4289b0e7428a62

SHA256
3b174ef1efe5440354d0bb36a2b3bf6ab64349d121c8597efea6b8ba72766321

SHA512
159f3517ff09d470ffc71657b0d757eb5b34c49762a53def4b81f72fb5ca2058c6ba759404ce660ebe141f157cd124356d95b8e6fce238b2252b7993e502b77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c5946bf7e48527dedbbfbbc3c64b5b7

SHA1
6507c902e25d432cdeac9dc9fd12aca56fe29326

SHA256
58bcd4838159dda48dd85ffa3416b50d42dec4eb7ef6803957108e079c6f1b41

SHA512
88c39280845bd135488faf3383886e9a1a386ec833e451322ff4fd60ebf237150f72bab000c6b2e4ea816ac5ef84088a9b66ab34ca88e87640bc7c7251ff2acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
84f6076805f9c3ea828fb3e4fd679ff2

SHA1
c4d8ffa8614349af97ef77ef369761810d93ec66

SHA256
6f0a6858fabf8c0657e182cca431ac968281ce9fabb51f86c8e0936f00d10350

SHA512
e6f60dc933da8028281cfca058f5d6a72999a5c1d93e5f7dcd0caed33535ded6b6af72c95c8f2332ad815dc0f9c829c793a8b649fbcaebdb9a4e6f05cc75a41a

Download Submit