kinsing | hxxps://www[.]google[.]com/url?hl=en&q=hxxps://google[.]com/url?sa%3Dt%26q%3DH%26rct%3Dp%26esrc%3Dcru%26source%3Dweb%26cd%3DXQB%26cad%3DuQxMt%26ved%3DBba0EUC3VzYm%26uact%3D24%26url%3D%2561%256D%2570%252F%2567%256F%256F%2567%256C%2565%252E%2561%2565%252F%2561%256D%2570%252F%2574%2569%256E%2579%2575%2572%256C%252E%2563%256F%256D%252F%2532%2537%2579%2538%2572%2563%2534%257A%26opi%3D385416742129%26usg%3DvY3uTcWChAKOg&source=gmail&ust=1706259535901000&usg=AOvVaw0-qj7hr0bu4pPE0rEabIY_

Analysis

max time kernel
277s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/url?hl=en&q=https://google.com/url?sa%3Dt%26q%3DH%26rct%3Dp%26esrc%3Dcru%26source%3Dweb%26cd%3DXQB%26cad%3DuQxMt%26ved%3DBba0EUC3VzYm%26uact%3D24%26url%3D%2561%256D%2570%252F%2567%256F%256F%2567%256C%2565%252E%2561%2565%252F%2561%256D%2570%252F%2574%2569%256E%2579%2575%2572%256C%252E%2563%256F%256D%252F%2532%2537%2579%2538%2572%2563%2534%257A%26opi%3D385416742129%26usg%3DvY3uTcWChAKOg&source=gmail&ust=1706259535901000&usg=AOvVaw0-qj7hr0bu4pPE0rEabIY_

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4556	msedge.exe
4556	msedge.exe
2896	msedge.exe
2896	msedge.exe
1152	identity_helper.exe
1152	identity_helper.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4556 wrote to memory of 3096	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 3096	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5084	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 2896	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 2896	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe
PID 4556 wrote to memory of 5064	4556	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/url?hl=en&q=https://google.com/url?sa%3Dt%26q%3DH%26rct%3Dp%26esrc%3Dcru%26source%3Dweb%26cd%3DXQB%26cad%3DuQxMt%26ved%3DBba0EUC3VzYm%26uact%3D24%26url%3D%2561%256D%2570%252F%2567%256F%256F%2567%256C%2565%252E%2561%2565%252F%2561%256D%2570%252F%2574%2569%256E%2579%2575%2572%256C%252E%2563%256F%256D%252F%2532%2537%2579%2538%2572%2563%2534%257A%26opi%3D385416742129%26usg%3DvY3uTcWChAKOg&source=gmail&ust=1706259535901000&usg=AOvVaw0-qj7hr0bu4pPE0rEabIY_
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe353e46f8,0x7ffe353e4708,0x7ffe353e4718
2⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
2⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
2⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
2⤵
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
2⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
2⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
2⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
2⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
2⤵
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
44fb4b00dff8b512324ceba1a6141cd9

SHA1
be55ffe98b5b75087480af9480fa545f44f91ca8

SHA256
8917df6367c09fc9e8b7008b892527b98c9881d4a711f135fbcbb75a1377934c

SHA512
43c01ec8bb9882767653ebc7175f51de84f9ce66b8a32fb477a27594fc57b4ceda6b0c9f0c6c8c132f10e404f52861a61b7cc88e2c7dc83e308e73b4d8166ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a8468cbdc248590771e766876ab5c04f

SHA1
350ac6a1f7a2f0a7883f5e9d14e967c7c434dfef

SHA256
5569e5a8d49e74cca4c4ec080a5b17e8f7c2e8179111b11a83303e2b69cf51b6

SHA512
bfe7d52819aa7b9d228a59358e5a9fee024c285a4feb16fc034d939919e3751b38422b6c11ffb675eb2955dcf4fb7744bdf162019a577128e468580e621b7471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a9fb119549195eb9bc4f84756351c323

SHA1
eaace192999e90d7dd66d2a0f77ffa156a92e702

SHA256
de58c22d9b8ca3310ed1f8a511ee4baa6b2fe0c653d13241d8402e324bb43c98

SHA512
28035c5ba7e6a7bf37441ccb51d45386e84b6e2c897f82e207472f938a0641010c4c848ae04787853de7d7db22f20108e61ba8552eebb9bea43b20fea7e200e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ce440fc120c28429fae47f953a4d23b4

SHA1
d766305c1c4fa7ad8147c0ec1cb9ee938c0adbf4

SHA256
81e62b921548bde4576c821c0ead34cf8058d5dd2d4f9d9e7d0b7300b870e8d8

SHA512
efbdba243b4fb80557b9d97f9c8be72959172d75018571e7853875437370fce9b0d0837a756b603d9113a27bd827e75a9d618f3ba74564390dcce23771fbdb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
914bc04cc40890bd3f53ce32626c9bdd

SHA1
6925e48c1073b43fdffd6db076a7441568404604

SHA256
5053ec309118c55b0560f8cd4d7d8ca263de5ff82997e41d5bd56f415c9fc1d2

SHA512
3e3eb4524ca33020854a3c3f652b4d5ba02dc6fd62c5808908f4e5a106b06a62beaff5e7f6b5fddeaec10b793ba9dc6c75ba321979a112fe3478f5649dba3760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
ad41016255ffc6e76e82f58e4d427253

SHA1
12708dbff4e674b8d1e325349509a030efef988c

SHA256
bd972909f31a7b9fa4d0e7bf2b62800fe8c0f376e687318f9d698f51abfced75

SHA512
9ef9cbfee5d1644ad39273465fa1c718d8d9f3dded16e68c9b19275e5511e7e01ee0418a538af4c9f19b5a4401a22b88a78955d8d9b06a7d99ecc1f21a8df449

Download Submit
\??\pipe\LOCAL\crashpad_4556_USPFVHMWNAXZPPCD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit