hxxps://vqr[.]vc/qyvX8ZbCN

Analysis

max time kernel
841s
max time network
845s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-01-2025 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://vqr.vc/qyvX8ZbCN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
4200	msedge.exe
4200	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2812	4200	msedge.exe	82
PID 4200 wrote to memory of 2812	4200	msedge.exe	82
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 4000	4200	msedge.exe	84
PID 4200 wrote to memory of 1964	4200	msedge.exe	85
PID 4200 wrote to memory of 1964	4200	msedge.exe	85
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86
PID 4200 wrote to memory of 5004	4200	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://vqr.vc/qyvX8ZbCN
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7fff6ad346f8,0x7fff6ad34708,0x7fff6ad34718
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7d9365460,0x7ff7d9365470,0x7ff7d9365480
    3⤵
    PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15708896843119559841,2404164407415845345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
254fc2a9d1a15f391d493bff79f66f08

SHA1
6165d5a9de512bb33a82d99d141a2562aa1aabfb

SHA256
2bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0

SHA512
484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5408de1548eb3231accfb9f086f2b9db

SHA1
f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a

SHA256
3052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670

SHA512
783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
95a3233f3d45025b21490b8108b69bcb

SHA1
833318eb6740901fe2c03a5b496068830f31ce06

SHA256
02bd5b16a45f0673268597446b1bf5f10f3dc1c372a2ac8675e094f0718ce5f6

SHA512
330959ca6f054577187a47d709b85a3c42ee834b087f1a352c4a499cae5cdad958beb042fc08a12e52f531dab20626c9cc898555d192e56da7fdf6b934a3cc5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
bc86b1ca2291318f7111fd40cae0edf3

SHA1
0f744936e2985d8280aab492ab249aac04ed86a9

SHA256
494fadece1fbf9033ceb74024c5a82ce1437df1a2c4732adffe4ce7de168ec1b

SHA512
155a9b639e4d64c446f597329e9a32ee262c1eae877124ca6b9ca920ac48346236423825c8f93e6ebc77024a1a4ae1553affa7d59334aa8f3dc88a42878da2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
450B

MD5
3646f6177f4381995f16af96e7f76a2b

SHA1
3a965e58285f64aa104585a3e9e15106dd8a3196

SHA256
58c25161bc490c134ab0f16531336fe906ae91274bc569279b4cfa0afbb7cd42

SHA512
850f4e48691ca8b4597c0fc9582bb5a0dc54673e2a82436911170f2cc923cfa325f07c08cabe40cb4ef8e8d07051f974a077837166cd02ea321fc0f3b688accf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5894aa.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f57bdd0cc8497c9c1a49d238f06ff430

SHA1
ddddb2abc7df81ed353a0f72e8ec3be87e8f0045

SHA256
8d18d7c17ab36f8c814418855deb38576749b311610e93a748e0475de933f857

SHA512
e9b6cadf81904be978348fd1af70188e2e779b6c7a1649c994b3a746fa05c851ce634767b8aed02a59bd9244a8b6d9b7bcad513eef556d38cfe8b51e94b19174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d210ce39b648d74470289298629701f

SHA1
dd6824a7e53721dcfc525a6e306a708d991337e8

SHA256
3bcc9d14f5861dda61ba0764d2dd0a8a2659f437d15dc86c110146b4e0f7ff1a

SHA512
917e6902b8b1ef515314fcb90801a6186d09d88d1e8810d1d393c9b734ce27c7f72cd89f64ad43d85848a22cc17b04ab7d589ee53a8008a8154912a2940ef393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f75420f5e9464f6499ee648957e1bb9

SHA1
38b0a040ffe73b14c0ff041fd95603a19d8caccc

SHA256
fac010449b526b83dd950157ff33ae6051ac47dc43521dc157ef3205085259be

SHA512
7254c9b2dd92f45f879d9bb1a53e1307ab102e15b0e281a5e122adfe04efc9c5ff889cb9b86ddadbc97f53bb47e83b93251a9c40d815cb84de502932b15707b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
48febe0b0625901956573dfb2378e7ed

SHA1
c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24

SHA256
f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0

SHA512
fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc3a0ca62cfef580ff9ebbb7afc92b9b

SHA1
fde9832ce521fcd53850d0701a543ef75b772e3b

SHA256
b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464

SHA512
fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
2f0639a5b2277f60dd694c4cb2ba19fc

SHA1
0b4b753a2aca46bd406511a03814bc420670686e

SHA256
49231b4563e590e25959a209d797d2b5f43afdde290260e55553c386387e0e13

SHA512
b6ac4116ee0a098683805f6067ae1ac8d719d9f974a108cb5376c16fad5b19770946b7f66538399fa22f9d5feaffe0f65732c9485089ee66090dcd7eeb5d7ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
ef429f00f38198aa53390e9882772266

SHA1
a1376d0db2754fe2d4381448765219834457454f

SHA256
3e92bb49eae1e6319f071717f048d9cc0d14436e0a728b4f8415ff24cbf8d040

SHA512
9361fb886e10c60f8426e821489c4c7d19419b7712b784aad58c1bd514bf96829ed473d20121f85e603fae2511a54ca1f3cdd27b01637962429b7b55e220c928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e704.TMP

Filesize
371B

MD5
3f0f7f3d2a31c68b4bdeff8761421e68

SHA1
4e7492322502dc7f4c9ed1b19c0df8dc350e4c6e

SHA256
773f5c4ed9593adba4411b1102b10b4ade7e12d5c153ffc44a3e378b78b458cf

SHA512
d7753ce817043c9dafe7ee6d9b482423138410458706e9ffec57b369a8dbefb675b5f33733b3528b60825a14e59e52ffe2654e67cf5665a36446b38b8ef078f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6cf4341-5dcf-4702-bbe6-f975cf3e578c.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d0b05ce7bda6e1a454590dd5a67c2acb

SHA1
c45daca0e5b696bae2f75ca36241a544db78f00f

SHA256
a82c0ed7abb4f4ad7a47b7f0f7d994be8d5bc9834cc0954d44bf0d07877602a2

SHA512
f468bf82cb2566bd2cd6eb6b41ccee139be5f705dbae420297931f656b1c934a4ced3237efdbfd700b0b7b1b3b6a81db19fdfef13ce45057ec01318f30e9f615

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
773127ec06649df54b3773a5d2b29c97

SHA1
260ba8c61476cfec46a9c416bde491dc049c08e9

SHA256
282974d78a84a06b345f1704d3252a85e25603e1acbc712a7b59ec47dcebad65

SHA512
5c879fb82bbfb716cad05390b0ad18b263db5582d2dc503790608838d6ac575a40ac38b44d09d12424ffc90ecef790e39159e5e5816c445a578bdc04cb660ffd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
60655f90c00008384530ba886c3c2e29

SHA1
c511ed9e5bc65359b0fee2ddf5f980b697cacaf1

SHA256
a94f2feb5404a62eb7201fd53f15ebe0a21bee9c64785bcfab14e6ab7ea45271

SHA512
6b388109202643574c342b7a1dec0a40de51ca29bf00083d10a341359b2cbec9a192707c91fef8ca37c9d22285e53300dc814ec8d78cd129f7dc89c781365b04

Download Submit