hxxps://jsdjuekdjdjmshddj[.]financialcareadvisers[.]com/?kk=Y21hY2RvbmFsZEBtYXRyaXgtc29sdXRpb25zLmNvbQ==%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A

Analysis

max time kernel
1680s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://jsdjuekdjdjmshddj.financialcareadvisers.com/?kk=Y21hY2RvbmFsZEBtYXRyaXgtc29sdXRpb25zLmNvbQ==%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4840	msedge.exe
4840	msedge.exe
2244	identity_helper.exe
2244	identity_helper.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4920	4840	msedge.exe	84
PID 4840 wrote to memory of 4920	4840	msedge.exe	84
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 2216	4840	msedge.exe	85
PID 4840 wrote to memory of 4700	4840	msedge.exe	86
PID 4840 wrote to memory of 4700	4840	msedge.exe	86
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87
PID 4840 wrote to memory of 3476	4840	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://jsdjuekdjdjmshddj.financialcareadvisers.com/?kk=Y21hY2RvbmFsZEBtYXRyaXgtc29sdXRpb25zLmNvbQ==%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A$$%C3%83%C2%A3%C3%A2%C2%82%C2%AC%C3%A2%C2%80%C2%9A
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefb2f46f8,0x7ffefb2f4708,0x7ffefb2f4718
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4873746916021178843,12812102731548435515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
4246df82e810c73c79a8961b5828731c

SHA1
86a60c8b12a981ccda556c7afaf5b93ed9c25da5

SHA256
476311293b48d483e0e1167af87af276c5c62cf446f1064051fa73ed40f16fc7

SHA512
f53b589492532271f14fb6e53b7354fc117499fec3129dfb1826469cdde9f833b0e24640ac91554cb7702a6b8348ae5b296167b46425c857aaf93fc78de2f4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
363B

MD5
5f322bcca240227e562b398d5b9a3316

SHA1
3496fb55f54d2086fdf65c30153939911fadfc5c

SHA256
33e93e08bf7b0dcb15897875aaa7ac410dad5068e039802e9533a4d166031690

SHA512
69066c2b56d069b5921d2f9b169240f2d06a65c00673199d30497cca6085dbe92ac6b3523ff436b6b59ab7665969d80798deb38fc1740cfb2431da71700ce6fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c79bec1926cf4f4dd6a5a41ae37b8ef4

SHA1
027e6205d4f4b54b77d6ab8e53f4337aa411c0db

SHA256
4b4b9ca6ca2773e1484b1ae4568014456ae946bf6726ba774a0ea0e42aefb5da

SHA512
4d6e71169657b0aa5a6712b0b919a33bb71e09252fec0156e967a84a36915f97b210c8f68d1b2becf81c13f929fd3c42930d0f6a7b0f6dcb0cd3d7491562bba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b05b8bf8ef3b941acb750e7b06d32733

SHA1
321d2b4a8c25d2cfe429f9413460c0d906fa699d

SHA256
8cbd3684973639ee00da85e8a35067efbf08a02693d15d6b2899351f8f598039

SHA512
a1fe7068713e7961421f37d2d7aea0cff560303b5d37d6de81ceb3ff874c77b38c5d715b09326ff805939515cef7d287e4b307068affd392a1116f360c153307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6f4fd1f76f30de10777c4fc5b03a4a5

SHA1
e9dbd9d4dbdbf50550b5637c0c7a3e399f9fe43c

SHA256
778af612b8835c3ad7b68e1934057a94b551d096831491254b13953a509efc70

SHA512
ab4ee6ad193319520e905564e4235df3e3d5c1a645e1e617fdf75781a9749f4d27be1a3c450ee0c09264f5a568529aef57992f29040524babf246cc811b551fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f344f543-7567-44cd-a791-4cf32512ad98.tmp

Filesize
211B

MD5
fc5c58523afb6373769969fb1edc4684

SHA1
c3518920da3001856055cc1d4bdb0499eac84edf

SHA256
a3ecdcd23dc5420968906d2acb78259013d0e2a35a9e1b8c377e7c244d33993a

SHA512
21fe3f2a2d5446d8d9e883ba3929c401248330bf555c939823c66d9e7d50e9c6d6101dc62133630254c4d5abc68cc53eb5bc6bd713ba8cd131c44646366de815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4e65974f96d95ce58deb218af49f043f

SHA1
8b1797415590f0c8a8b0d39ae80b6e2d016a4656

SHA256
866240139d797fcc8c1b1225ab92924ee509b70a972568ecd0dfedc8d8b0af5b

SHA512
7ccf5d14de07cf2bf548536f3812865c5967025a7a6ae95bfbd21733544d1d529b104406671857410987301d737d5fbd23a307a461dff49741292f1a53874c8f

Download Submit