hxxps://share[.]hsforms[.]com/1IRrYqkWKQoiBbzgMszUPYQsxda8

Resubmissions

19-12-2024 14:29

241219-rtpyhsvlbl 3

19-12-2024 14:27

241219-rsmf1avlan 5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://share.hsforms.com/1IRrYqkWKQoiBbzgMszUPYQsxda8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
1464	msedge.exe
1464	msedge.exe
5008	identity_helper.exe
5008	identity_helper.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 3204	1464	msedge.exe	83
PID 1464 wrote to memory of 3204	1464	msedge.exe	83
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 2568	1464	msedge.exe	84
PID 1464 wrote to memory of 116	1464	msedge.exe	85
PID 1464 wrote to memory of 116	1464	msedge.exe	85
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86
PID 1464 wrote to memory of 4016	1464	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://share.hsforms.com/1IRrYqkWKQoiBbzgMszUPYQsxda8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a0946f8,0x7ffa3a094708,0x7ffa3a094718
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6074286295483460431,15210901178461693548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
215KB

MD5
eacecba98e67f8f56955f04607fdf075

SHA1
20c99a5040d911c6f6c050f90115b0a142d581e7

SHA256
d6f1945b10d768831770bb1459cc5b11e247c5b5a757190a41a4edc51d34269c

SHA512
2b6a0c2bf5017a6b06d6cc67e49ed1280864cbde7b202d4314a18b4fd237202cd08234de07c895d7ff2574473288d00a25048143df2459bf1cb85c6b5360cbad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\05cf05598c8c9087_0

Filesize
19KB

MD5
633e8841a641bda49a4b94ddbb362428

SHA1
4012c6961a0a99632e54941afc76d734cf4ed09e

SHA256
cc8aa648fde0fc86803ab3d034f7f319fd342e52531baf1b253076a207f55caf

SHA512
390bdcca8a4e29a4ac6b6d7f1b7d0424b889ea1d61bec0d58800188448ca9b589858be18343f99d542fdc6e707942e3aad3db77dd036f36510bf46c79006c59d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
2bddc365dbc52db453645ebf43fb4165

SHA1
d3b466ee639051e5f4df7ff7e98220622e514735

SHA256
96af5952035a91446bcce10b487820f369792582b5190fd6085dd1de265cbc7e

SHA512
9fbb434e0b2ec6d05b2590c3b68a9d46e95e3d248a18171d166ca63b26428a3375af91fb7e758b2363f4f5e804f6d2413e5fc0ce4557ec097e9753d27f3e7c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
7ada02d82120f730308d65186e1c095a

SHA1
45f6e29e8797f715f724494abd7a2712659af85f

SHA256
df1163b0c6fd5ab8e167bca88e3f15e4680e80158d5d11f98db436f80f989d24

SHA512
f6c35c0caa8c719970f66b9b89b2bc89ff649d84cadbc91f2364fec57190ca55c2d21617c4feefc9697d2b645aab32688e0b5b381ad02fc1caa88502b8039e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
ce7bfbb8b8b15199b6c4cadcd9063b4f

SHA1
f4202ab3d90b748012160cb6884987afa9499f09

SHA256
6e5e0c69e3289930f9852745221cc3c6e35c34d513e23af8238bcf8b80af57a6

SHA512
717b6142c178861fbd022a127247cd7f1be32123a6cbfb5ac8c7f7af347cc417bd6a1ca34346631ed58f76d0237922bc0272967c990a0bc60c3e1aff70e47b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
fe40cc16037b8b55dd748555fb6144e4

SHA1
4cc018b0c4fcd3c674f0585d155d1ea2d3feecfd

SHA256
d4d91ce8ab60a4bd0d02ca7c64c599e7ff337d01dfed461cd9f7a9958431ed8c

SHA512
69c01e0a62b76b6bfb51eb9aed5e2c2218352761d8f31df137fdeb8a5ee04a4417e5150a9b7b933f4a446753445228c64c8cf8c8843fb88d4194335e7f7def9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4015234809408ba10a5d13636a67f04e

SHA1
9c908f73dd5662cbd92a506ba761f1af426272cf

SHA256
ea74ff5e2c2525d9803302651a2339c105f515d85eac1a73aa0e2c1332429863

SHA512
97c2e0f9dea68e877372de75599e821e8799ac8fbab6ead8567a0e9ba1bb875a4b0702f93071ebe62e8e58f608cf48dd637633da2dc11200c487b2201998fdf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2ab0b9ef004ff6bc9a2c0cb9dbda33bf

SHA1
12fb8c6b68988674e25348392a0a0c495585048c

SHA256
b925c015dbe95d266196a9a8dbcad730ab04fb0b571d3d6262b491f8adfd745c

SHA512
1648bb35cb71c67ef5b35a3804bbf01199c1496664d5d0a69be3939e87a894eddfdf80817f095d03aa87ad1c947e57ac8896d5d596eb5438ac8336f3c865c885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5510cc58c491021ab13f8137c3059fe0

SHA1
9c964f7891c5c8b9c0540d67bed28903be94cb03

SHA256
5c4719d86c30a9ccb2ed1ecf03c36d71597b23791ae03ec4321ccda6f72b4abd

SHA512
e28074e64ce6b7924b8288df17bee476da7659a539447e2093ac857fe8e6158c280955b8c05c085821e6e7fb6ce01d624ba5f439f61af8bd00cc4fbc389fa00f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27edac75d00b11c262df721bd2a7f672

SHA1
87ef24074b8d7290bf0cc7cfafd3944ebaa6637f

SHA256
935f01f839f856c9e905aadd5f72dc19e3d8de963d65e957a0e075dba5a2be24

SHA512
38982d341038c963b2127edeabf69ced7f8020d6378a6d33b5bf6c8bbade11df37aec3d5a39bebcdcf70e9daa6d43529b1f3337a42acd9b2bb692a103ede647b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b715f99d4b1c8bbb3f6e089711c234ca

SHA1
d47e0e11e42d12f9940447a668ea050698c25c86

SHA256
703eacc37270f392e7dd7553307a4844f8d9a841faf2a6d61993c4e97a725ef0

SHA512
c957a31703864517dd79077507f35be1607c184dbcf9ded9ebb1b0db8201d54cca1ad9fa55e5e29a1b627bcc04fa7a07a3c2484412531411d5771404705b7655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4b024a19e957bf0f8e34ee888c00641

SHA1
ff7d115e0201b25ada77cffd0098f0d951e67e40

SHA256
912a716f29bd443134eb271eb768e0924667ab7e34252d490156bacd75f533f5

SHA512
c252abbf6adeb60d014281468f5b3257e5d9950779b0098a3ea8cfdf87a5caaf70fbc9529e6d410ae8f3fc450780385d394a6ff01b0e9e67a508ce415d6fb8b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5822d5.TMP

Filesize
1KB

MD5
573878b4458e01b2e74d9fc10f89482a

SHA1
3d945ef8dfb688d0569cdc6c3777f3fee44da0a8

SHA256
c6bc476e771659b3b2526f1c70e41d840efd4d43a805aeb12e7753851928366e

SHA512
e3063e8d768fc2c2c9f1d87f92c7c3dae25293b4694b86a5c3adbf64436c5e13db5f862ba7967c506679c4136ad74ffb29fcd7839ce0731abcaf06733c9d8403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7e35472a39028df3c37204900205336e

SHA1
1a8a089fd02bf549679c7022755d676a183462e1

SHA256
25979cb5d74792f2513cf4d8ec4dd217678c45cdfa7a73ca97bc72a1fda35655

SHA512
41be2a3dd72fba2c4c3002217fc8ff46cfb1bf2134c3902e55050f3f6b4eafba5f3f33525fff72555f92793cafb8c120e5e31eb7df7cbf92652dc608e8c07c8c

Download Submit