kinsing | hxxps://2n8w[.]app[.]link/?~channel=Email&~feature=ConfirmationEmail--AtocETicket&~campaign=WebToApp&~tags=locale%3Den_GB&~tags=version%3D1&~tags=marketing_code%3DBSH3675&$android_url=https%3A%2F%2Fplay[.]google[.]com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom[.]thetrainline%26hl%3Den-GB&$android_deepview=false&$android_passive_deepview=false&$ios_url=https%3A%2F%2Fitunes[.]apple[.]com%2FGB%2Fapp%2Fthetrainline%2Fid334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=hxxps://kislaklar[.]com/way/ojtv61/paul[.]dejonge@notts[.]police[.]uk

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://2n8w.app.link/?~channel=Email&~feature=ConfirmationEmail--AtocETicket&~campaign=WebToApp&~tags=locale%3Den_GB&~tags=version%3D1&~tags=marketing_code%3DBSH3675&$android_url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.thetrainline%26hl%3Den-GB&$android_deepview=false&$android_passive_deepview=false&$ios_url=https%3A%2F%2Fitunes.apple.com%2FGB%2Fapp%2Fthetrainline%2Fid334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=https://kislaklar.com/way/ojtv61/[email protected]

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1424	msedge.exe
1424	msedge.exe
2796	msedge.exe
2796	msedge.exe
2300	identity_helper.exe
2300	identity_helper.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2796 wrote to memory of 1488	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 1488	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 2028	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 1424	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 1424	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe
PID 2796 wrote to memory of 4448	2796	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2n8w.app.link/?~channel=Email&~feature=ConfirmationEmail--AtocETicket&~campaign=WebToApp&~tags=locale%3Den_GB&~tags=version%3D1&~tags=marketing_code%3DBSH3675&$android_url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.thetrainline%26hl%3Den-GB&$android_deepview=false&$android_passive_deepview=false&$ios_url=https%3A%2F%2Fitunes.apple.com%2FGB%2Fapp%2Fthetrainline%2Fid334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=https://kislaklar.com/way/ojtv61/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff986e146f8,0x7ff986e14708,0x7ff986e14718
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
2⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
2⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
2⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
2⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
2⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
2⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
2⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15214446709952427111,8716076292481805996,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c3446cf-9737-45b4-8b32-17ca45502042.tmp
Filesize
6KB

MD5
2a62af8c55701a371a831bf3046ec39e

SHA1
3fc97f141abe158afa86aceb18ea9e7a2bf6f654

SHA256
c38738e2e5e8c3d2f25f58f65018156766fe5278d5e4fff8ad3e8e6d8cc9d114

SHA512
36a842db5aa7398a8c8e01069ee3e8717e2c4f4b9501588ae5f87f83edac041a673a6f5da3b4eb2cfb0f58716522c99325bd0ba0d2f5c1c35fec30d74d3ec0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
cb002fe5fe89d0676cfa989e6d941a39

SHA1
3a1fb9629cd4eea459b6e9f8d4f506049d4dd39f

SHA256
4fc63fe7274c068f6640c3a461c9e2d3e525368491edbd271752306c1f6e0537

SHA512
1c4ad837ff8d09b98199fd128e1dcc25531c7a25b0d96584a26f326647b099c37eb365eae78217fe56be047837bf0a1446dd8b6d370bdcffc8db57bbd5a82c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
430a929279b2386653827ba686a795e1

SHA1
c247f3e7afdb1ce361d7c7fd60ce803bda7b4e4c

SHA256
4717a2b81c49c69111bba994bac879ab89e32b849e379125149728207571e3df

SHA512
a42352899c7a67cdff234fea23c4c44848e5351e77d51a25a569e41ff1117b7b9d00ac44da57fcab3b750eded52eb46e7d6e474678bf069f15c761205308f4bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
835e7e2d2a54a2f18943b4d2ff75aa15

SHA1
e4a03257f66760d20c5894517a83b0efdda2e76b

SHA256
d5dd68e2e64f58d2acb6b776f985129b0f0a6a346ca8fdcd97c96e40b93f57f7

SHA512
9a20bdc5d3ca92151e88308d49c0abddd6af19a8784df09782e2a81614e75fc89ff4601adc740e2c62dbadae7b8aba721aef4bc2145feb1f1df1f949e404acfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2f45f0b6698480842ea6271d0027dbf4

SHA1
e862770254c32f6cfbd3ede3ece40328a1327edf

SHA256
1f620aa32da24c9513e4638a2643389f145f2af19ed06d983510afd9764b73bc

SHA512
2b136df83b8633bba2e1165d2fdfa7c8f8cc6366e1a7c8aee9ad2036d09cbe139d3ddf7917a90d2da0aa143423abbf8637413390b8d0c757f6841438e773d648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
dc552488e9ca7c58c4e020074b535e0c

SHA1
cb2037692b658882d7c7b48e01977b5771ddbfd9

SHA256
1ed91f2367881edb23d98cfcf76122306fefde430c4792c69349feee3975b021

SHA512
d2a1dbbf546086a740b5c3ee7edb49d5c655c6c5e5e8b529b98263c4711f589b7d76d5c4c58acfb7e08bf28fdf207f6b6cd69e95c67cb351b5928e868933698b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
22806a5414714d31656d06ce259f1327

SHA1
23e4608a968b8d6861bf0397a15418817ddf4743

SHA256
b8f1bbf903c50f156108d2c9e3504d681c6b1032f55d3c6e1aefe1e42421c42d

SHA512
76a8f8bd0b32f70a2c11eaf172b1313ab577ad2ddb18fae59d3d3fae9756d83bab9f839e86441bb9500612fee57c6993e59798b078424e9da5bc985de1e24541

Download Submit
\??\pipe\LOCAL\crashpad_2796_IALYRRJYEAFIFGJC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit