hxxps://ynotlook[.]com/eurocity-train-zurich-lugano-2nd-class/?utm_campaign=9LxaIa0BIw&utm_medium=group&utm_content=placement&utm_term=keyword&fbclid&fbpixel

Analysis

max time kernel
196s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2023, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ynotlook.com/eurocity-train-zurich-lugano-2nd-class/?utm_campaign=9LxaIa0BIw&utm_medium=group&utm_content=placement&utm_term=keyword&fbclid&fbpixel

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1380	msedge.exe
1380	msedge.exe
1936	identity_helper.exe
1936	identity_helper.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2168	1380	msedge.exe	81
PID 1380 wrote to memory of 2168	1380	msedge.exe	81
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 4324	1380	msedge.exe	83
PID 1380 wrote to memory of 1432	1380	msedge.exe	82
PID 1380 wrote to memory of 1432	1380	msedge.exe	82
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84
PID 1380 wrote to memory of 2796	1380	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ynotlook.com/eurocity-train-zurich-lugano-2nd-class/?utm_campaign=9LxaIa0BIw&utm_medium=group&utm_content=placement&utm_term=keyword&fbclid&fbpixel
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b76546f8,0x7ff9b7654708,0x7ff9b7654718
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17239905754739938854,7560997904068324277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
f1f4a9d95d2e77330fbbd8f3611ca3ee

SHA1
e4f6f477fd0e2b73e80570280cfeb259e3da9ad5

SHA256
cc165b4c0ad4b4767d898dcc5300087796d7753859d8bd41b4cabd342beec8b8

SHA512
7dfa3e45e52b691ff1f51658b124833648934c0be3ec5b289c2a5f7e018141bd2edec104cd01b0b581503c9c91add0c617fec59767e0cb9b901a93ba450204ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4c2516c25ecc81f2b570c0c4a7c79d37

SHA1
2f65618742deb12008a584b1ae52f8c66f225529

SHA256
48de2d6af9383f2aa339e034f1908c6837ccca23cb8a480a88a1d72024c9b561

SHA512
fbcb971527032c394ea0d413866655e2a23cbde8607994651929ad3a636793864ebd81fe67f5608e30bf51267b500c9685822b0cd280460bc817a55306d1d210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bb14fcdb0cb784106d793a7d6a117dba

SHA1
86263befb00761d52d4a1d397de17ed9bd18f0d6

SHA256
415ac0fcab1ec1c8c48f89dbc7a6d122cff221b6baa89ed536e2f473818f0f1f

SHA512
b1036633f9728c540c1b2864d563782358aa0fc1c41b06e2932fc60d69ada895b91025536589c8915e97bfbbd02d898f1e4b01a7e4d5c839f9073a065a387307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78c42d67f3cada5ec90a932b6b81cc7e

SHA1
db2993a1a4624bef42cd0f690cdcaa141440797a

SHA256
8d432776534cd633626c14dc2cce895aac2a31fe3a976dbd27f2b65e137b8c1d

SHA512
6f8d13d591e3498942387b92e7506f9ed9c6f6fe73bfe4d393a78ea1bfdb4c5ee6c2f8e81f160e642471a3e4ac4220582d10537866b15e5f8a7b7802b4f3b1f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0333dc482b4d56f74b2dc710d3ad5ad0

SHA1
8df571039bdb6b6c29e590db34856cb236c7f4a8

SHA256
04f9d5a6097aa53156d87c37b67237f0fbd1857c82203cba73ae0e6b241d4af9

SHA512
261287f4907d70eab9442520801e82f0a5608a1cdfbc9e9a823f1bc9548f7cf4a6e1757caf11f3085e009f9bdc350e2b84e7ca5666120d46e20702257ba55fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
524c50dd2431c3fcd66fe20748f54441

SHA1
791254c037ba38a5a1668ab4540e57139d14b9cc

SHA256
0ba4ccbd9c4e21e487811a3dcea2f99f61bc959303bb8fc8213b2f1475daa19e

SHA512
213c8e6ef7be5daaf5ada866a9f0f368974e2a013d116cc4277be7e5a590a5021bfb8f96fec81607ff17bc416cbf7eb6e3d0e5fa8615361fcf7fc3386b80762f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
c3538c77455ca4e2458f304a46cdeccc

SHA1
ed5331df50c1c8f9cced6739d329a64b0eaf91bc

SHA256
700a1ab33bfbb1a97dde50ad4c6bdd0c48f3d15b0534f0a3584b30ffd808f0f0

SHA512
67f737fba65266212053f141829da83c1ad3a40cd3a3e78d081f8a1de9a1d11dc5b918fef09a94c13f8f8ef444235b529d4e96641455907bc0c5d3583bae921d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589834.TMP

Filesize
873B

MD5
acdf1f6145bc94abf8022f862c6185c1

SHA1
5bd7569093bdee5b24ca37b186e8b61bb73dbd79

SHA256
887ed144b7c92c53714d550644f53fb583afea8f1c7dc4d8081830960b2500ea

SHA512
3c910d142dd2dfcd1ee07bb274ebf83b744dec14e9dfbec536fb4fe6471401be2a612d61151fd6009eca0c0e8a285496049df3896ba4990bb6b7438bbe171296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3760bab09adf5d93909655a4a31eae4d

SHA1
552d0336bf51bb052ba50e2aa541e422e187cb0f

SHA256
71320a608200dac0dda3067879e4941a4abba18a6840c640f538226c9becdecb

SHA512
2b240034573777eea1064b8f59da5787c3e614f7e994490f594332708afff6e19ea7b9fddda63506ce7949f01efd78c2188ede249f565fd49d12d7c0f1f70377

Download Submit