hxxps://t[.]ly/JGLLa

Analysis

max time kernel
208s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/JGLLa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
5032	msedge.exe
5032	msedge.exe
5268	identity_helper.exe
5268	identity_helper.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3552	5032	msedge.exe	86
PID 5032 wrote to memory of 3552	5032	msedge.exe	86
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 3388	5032	msedge.exe	87
PID 5032 wrote to memory of 4992	5032	msedge.exe	88
PID 5032 wrote to memory of 4992	5032	msedge.exe	88
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89
PID 5032 wrote to memory of 3540	5032	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.ly/JGLLa
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8812346f8,0x7ff881234708,0x7ff881234718
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18108296331412151603,14115861622548753657,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e5c27b4a4d5a3c9c60ba18cb867266e3

SHA1
dea55f1d4cdc831f943f4e56f4f8e9a926777600

SHA256
860ed0acc83eb0096cc8911725e2c631ff879ad8c35854577651af502c4b69c9

SHA512
56eda28e9c61e8081dadc220d23e7bb3320a9ba557eb7511d17a3d2836aa61f301d1d714a3d611eedd7c4b91886c790af7366b01acdb3b637f3dc4fb024f3f6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
50KB

MD5
c2d07353ca4e2a84adce57b61c36aae3

SHA1
c30cd4194b9b41eddfbbcac7a8c31de8b977cf92

SHA256
afe18866c9bf68bdea8591326d5131cbbf92d52c8f540637b323a99c253610ce

SHA512
973b1ebac4c942e8ecba25585e0cd3b649cd4ef7eb3a476e8c87f948983860d55c5b0dc8f7d66a9d7645d8ec6c63a49003c5ba3a069cff3c846f9d3f63570d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
75KB

MD5
1f59c447cbec4f502eb98ba71c6c0b96

SHA1
86e40e728acf27f1891b7c68c8c6be866f1c6232

SHA256
6a33a669f286f3716188dc2bf7fc3b81a89b06fef83e8e17bc2287844bb7fdc3

SHA512
b234216e1a7ee1862fbff8369bb39ccc5f89695f011fafa485530a90d2940a702baae540a7b4a0d7451b6de22ccd382142da82f3511e48eb82e9204f0a3472d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
88KB

MD5
82b2158312f3d7904b8a56032b45e091

SHA1
475c5bb59da396e02a22c34db8b6c40f316b6aeb

SHA256
544783b469e02ae2ac7409d53b2576b4251c54cb98d5254c6818d18730c2e2eb

SHA512
54635b5df4a0a27ffe356fa9ad218e0fa76927cb5243829f3d902a3436b2903852639d96f92b2b3b0edd1283c87e5a7edf1dc755f1d7ab29e2bc0d019a866099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
200KB

MD5
b3ba9decc3bb52ed5cca8158e05928a9

SHA1
19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

SHA256
8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

SHA512
86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
fbcc26931e0eb35c33ae7c57fcce65a6

SHA1
aa6fc3f2a91542aef2346cb870ddaba11338f297

SHA256
f6f80fa4c8bf77cd38445344a2bb710119d5af4e72ba45a210561c3d3aaf2251

SHA512
92d705abb1109555208e827ad81f609fefc42da38ff9c4ebe9af45b13d7c5c34a304be50032809ccb89925e8a902b1e13700c0be84bf38a464bad5c778029c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
71bae0d186f1853f6e6b576e66c135f9

SHA1
40e67be8d05e8951a282c4a449f853c940a46ad0

SHA256
a76d81f3b63e05485aa5cce8673d7c79d52af04308894035d26bee65509f6f77

SHA512
febb57acf7d1f9138a38059cb6ceb231740eea73d06e4ab59a5bc9ff7812219cc005c035e7a714a14d68d509a38ccc5cf5714c410dcbf70130e90e94b0550eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0a2bb70f17ee206e05043d62c50552e1

SHA1
dca1213118ea90c8804f88cdba066aa946be58e3

SHA256
80ce058f461bd71f99be682714b508907365dfe840ce7a37a7cbe15c7c52a470

SHA512
41c5df955b413f14016c6cfdd8427d4b69fc7492af5d9c1f3d53487d05bf43ae47bc8f9d78c6b52aa9acf26e115235a1c771242b5de4c790259712d79769af3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dc5edb58cfa16a2d4548d7c070305205

SHA1
a3bfb9e6ba9231ad9dd6639a664147c9bb9238e4

SHA256
6310a354cbd3ed5c288b4c2f0a129c82bab50100fdcb89a2c9bc91456dc373fa

SHA512
8f4943c4b7c917b107feebc484cda814a3b26c759a59dab4652dc14cf53b76ff6aefd188242278ff3ed36acd8afe1e43bb2cb48bb1d0ae40117ad0ce59876447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f3f1e785a6f475df56f631337018555c

SHA1
a5997d246c166c93ba7380674fd9f0c74abc26a0

SHA256
29bc730cd96dc1ed71ca16830d2abec1130223c4f5a16694e0a1fac48a36cb7c

SHA512
6d4bac3a16ebcb675c182ffd970eaa18aeaed458cdcfae183821d82d394c336aff7135151c9c1cd42d449f81c8bb6c302902e3520d1694103145095b93415199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
24cbdfa1eec06f253a890d8178422a26

SHA1
e22e5e4ace2fcef2f41737b0238114532e1380fa

SHA256
9c4fb054a904ab4053b3cb5f58c88be06d69a6ac99e8bbe85fdd3642856c5b28

SHA512
6436cb41b90388ddb162c07ba892c9802d03c22233fc387c099c7b36da1e7654216be42ecbeec37122fc9794e75324126f703ce1c85d2dda17eeeff1604b662c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d2b03f33584efbd0a200a81833230f7

SHA1
c7f7b3bd239f24c67d24e3b874c1cf3b5320f442

SHA256
042425ab9bb8a6183a85c06b9fd914ecb70ae5dc104b165251d7b1e3a64f0ad6

SHA512
4128e9e5cb09712b3c1574da928e95866a59d5af9388eafa746338c25224576b78efa4aa5b456de97443aeb9e722318f43e16c046c46029fc5be944db6032b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c767390b2da56941bd63b853b4c22987

SHA1
da5aee25fc3e3949b36d568376fb79f2a7691747

SHA256
0cddd79b972a163ce46e8f524575a2da6486d68f7b8f1759fdbb42bff87f4d33

SHA512
942eb4b06f6bc24ccf3926091f9c8c3817fa7489fd114e4c49974b786b3d496867c0ad473ae65a52d3fcee4211950a127997d4b670b12051876fb8490bab051e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5c335fea5a5b98e832cdae480385050a

SHA1
89e0796f12ec696e53e639ef667ad818682905c1

SHA256
f15a3fbf72fe3c5a7b901a4744906e96f5bf9450f83fde0f898d9adf0cba1fde

SHA512
a2cac9a94b3322964b0eaf69e73d2b1b055360c1d5e02900c01dd0a89197fbcd98fbdb5c0e2d3d303f31de36bc2eec95e4b2e9a503c0938b3663dbdf79526da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e30738d93d6789672ce8e1c4bfe275a8

SHA1
ce2195ec1f2e3830b9a106a9dc8d7fa5397d10fc

SHA256
7d60046d1238ff11bdf616d83c212ad6866a7cc630ee9be8580050dee7f74832

SHA512
e39c9590f558477a1b823de555bf27542a725566d8bd839a1c493459444d49d755445d8ff34f59681ede12a8e654c5a7fc34b6008c9abcfd65d09f6b1b523a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5e6d1872892440462e071541d10acac8

SHA1
b46c9649d1688e0050f3a6106b6550f5f7140dde

SHA256
229e4304132e6552f9baed2ded689ab570482ee7934347b05c5c5f0a210d9bcb

SHA512
a1b6d69cfdd4fbaf1e08233b6df803c73a2cdb2bb4f7f3ed37150b6a5d41643e2439eff15e3f14695991962a3e2782df99cf91e5dd9e68f878b4a4da97d5b68b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3eb3b46c660b19de388bec84672e831

SHA1
20e33ec2a606fcd462c3e7808fe5126a1c251b38

SHA256
e14eb279b01f2295c7f98dccaa4c132bf8d8c6dba9d68dc953a7959a9682b8f8

SHA512
0654eef1bb440cc3f6370e9154927729deb62e8ae3142b1b17ee60d5825710f1c7de6ab0599bfa6a7461e66d08c062cab6133b7bd2fe52e1004dd4eca2a0b3d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
663110ebf9e3e30a9eb81538727f74b3

SHA1
98ecf8ecb5a58728d096cef746b9cb12f8e6395a

SHA256
6e81376b93995cd8c647502a6338e95210a157835122b0cbd97b1f4271246742

SHA512
706720cb1b9d15f4e4ebc9a69e73b0b1dd4b50af00f256ec66e9b7f41c72b04411131d3f6c21e067561935598d33a3a0b0c6dbda25c56aebf190ce532af8bb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ffad.TMP

Filesize
1KB

MD5
877d07041e3b68cffa1e12e257930775

SHA1
42d217c9ad0df668c2b1f4f9e16b2af9bbdf827c

SHA256
0daf14c7051837be2213452dc0d97c91bc432f381b0026fe58dbc84c508e5422

SHA512
085605e3630284fa3899e9bd145373fd766e509bb99db3f9eb6eaede0a476fc2b44c0b1b93427a068f52c0fd97b5e474386c5563f42926199e7c2c14a62e7d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a5c6ff70b863c7cbd2eda11e50935e0

SHA1
7d883668cb986ea5970cca0536ed82fe4047fbdd

SHA256
1aae6c331b7c6414c2759298c8fb3472808a48e1520c28ed65558a2b2c746670

SHA512
6a42236bf990f7b9804cc3253b5799785df18113d3b0fa12277e1ada7c66f32af6249190fdac0c03ba89b2277dca8e453058e7ac75d1aa1325f8a6d47ff8ba5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
820c490c860e6ae0c1ed2a0532d6ac04

SHA1
223a89b7997d5d5427f3726b8a09a38d2f3b56d9

SHA256
a36657e5eee44770f8ecb9f13cabe6d3502adee2cebd356b50e1089a85ce5fed

SHA512
31fef6f526f72678ec0f62cb64906fd1557a218255586f9f72f3667850682a4573b744f3cda9c1ac605bfcdcc047c2875462d222cfd27996425f1391a9553ec0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit