hxxps://tinyurl[.]com/ypn899mh

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://tinyurl.com/ypn899mh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
1856	msedge.exe
1856	msedge.exe
4344	identity_helper.exe
4344	identity_helper.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 3032	1856	msedge.exe	14
PID 1856 wrote to memory of 3032	1856	msedge.exe	14
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 3752	1856	msedge.exe	31
PID 1856 wrote to memory of 5040	1856	msedge.exe	28
PID 1856 wrote to memory of 5040	1856	msedge.exe	28
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27
PID 1856 wrote to memory of 4088	1856	msedge.exe	27

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae54d46f8,0x7ffae54d4708,0x7ffae54d4718
1⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tinyurl.com/ypn899mh
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5331728113747273690,9762814426516825882,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75ecc32f-c15b-4b3c-b47f-b61491a876ed.tmp

Filesize
10KB

MD5
97fcc0dade670f89dd7defcbfde96b8d

SHA1
9a3b545d47fbca8d3228dc1040bcd91752475a64

SHA256
b457bd96942077a4045bcf766302060c89d2ba24c68c3ee0dc1b88544202b139

SHA512
f6fa08122aaeaaf8d8eea1977de6ef2813bce3c2d3ac49f21fd7c38ebcf0830ad92eea3e813a66619eb00cdcd101aae473e7e911ae95f1d2c6c640715ca1e4bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46d93c0d-53ca-43df-8c28-ec73afc43827.tmp

Filesize
6KB

MD5
978c5c4dc35e6d3057ac7bf390ea97e7

SHA1
363f1cbae75a61c9cebf4e5cc9fee0b89bea8978

SHA256
55e7f91d13a989c5762f2316d7ba5d1b7806674ff4bbaad6f6e1af5c9149e8d3

SHA512
d24fe005bca8583cfc131264d3cb372d27cc7bdcc4ad5752afecc617b41643080cf32bc115177aec83e896c6585813e2431581851968d439a1fc638f94550197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c398fcf1e0d2dc62d9d1ccb9b854b5a7

SHA1
1e238b95dbdc482b330d72bef9f8c9f1124f1593

SHA256
0e0f249aa8480216d470403352b0e621235748e8c40c45314e5803f0522b6f17

SHA512
7ddc49ac18dd0bcd7329e9370dbd39a97a037793c69a8fea344a984c8625f71e2e39836f4b3c2f1dd5fc1a008b65a4c048d4583d8dfa0a71ea31b990a037ce77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
bab7fa5684343d222a5628d26d50d0f8

SHA1
2f7cbf7f6a0bade59f929358fff24a14dca293ec

SHA256
92da05cb836f2beaf930aed3b976d2025176f0722b948f5b8da2c7aa1ef72e06

SHA512
271c442e8426db8aa7439b881d4603b390337873719c2ba5ca6c6133052c3d7b7905a499af1d31129fa5c8848dda6e0661b8ca2bd51a37042192b06ea29ff9a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
464B

MD5
4e03409e4a23ed0bd0406d6a3d5d36ad

SHA1
f699798363cc832cedc7451aad57186a88721453

SHA256
291a5e9c4441eba01a1902a491b62403222ede5c980a97d495ed678d5f0ec38d

SHA512
762f5f2cd0de5be39c5ed238eb10d0cffe9ab4b600952d115ee9d7108c29b9af70845b404be9c011e9939f4d87c47fbae49293797c152204b77c83fc7f5d2848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
403f28fe6e0ce31664749c30f2b905f0

SHA1
e184f747f4f316795b40fd12bf128e8a8e82b46a

SHA256
845262c76b40b1bc0ff0270fac12e38f904fac1be1d24e477dcf96218db1a93e

SHA512
8416cfb4dd479f9151614161900a9d1c6166cb97eaa9cd942e33086c8589e479f8e80f5d90e12517fff745da52f9e20eccae2d8f7ce2cbe1201947b51c14351f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de9ef129318f2aa09d51d083ab8a7173

SHA1
34f98b6e1b44d7363278ff05a23bee039e7cd7d9

SHA256
cf0dd2b81553c0f632bd7eb2e9298cd361da344b007cf35833b77cb9161829d5

SHA512
e9ce3ef2d95102f969526e065785e37f70f3edef17ed18ec287ab31fa388ac072a2222c0be2a04c4e68c5e409a601dfe3cc5f3c467e451d2644a8af7afcc2ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29a4a9812b0d1e7e25366803eaf20dd4

SHA1
a17a84defc30051b3d98619b8e550e82f2410039

SHA256
0558c8fdf95e8e268c9fa68c249d6e751d5b379df6b9c79cbb4f266281f375a0

SHA512
5fa31a60ed7419e9f20d88381a78632f4ff29d56757078cc9c472c1a86ede7126f22756ec79769ae9058f21620084c5f180ac09115f8a314e855901f01674459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3aed052bbd5c50613bad3120594688db

SHA1
c5967d7537d39a4f01c07c26b6dd9c615ac973d6

SHA256
40bed49d9e0839b0ab8196416bcb252a7d77538b33594e06796fba973de2f244

SHA512
f809418cbd844c4797b1447ca30f7b67c2aabd3836a86f1852dda1f3fd4fcec72ab3c30a0895b9b1aba33236d8f57572fb216ab9b7e35e68b047dee7fd333b2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
efbffe7d691b09d3638f3da3d9fda18e

SHA1
4feb260e7aa21d1b5aa7cb1e66f06cf676ca023f

SHA256
c400cb219e3573397f82188f021606e941d3209443982178b321e272a538d0e7

SHA512
d60d9890598d573473395be8d394ee24cfe7cddcd6b961c3c60e7e8ec3c2af1784d2f3fb5122ccd0ec45d78a9eee800716600f3876e8569c87dad02f112f18ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit