kinsing | hxxps://notifications[.]google[.]com/g/p/ANiao5o9MV5kZkNEgw12IoLfP85HvXVDENCIFOP8MaFjyh5ioJX7x1PPGhHwzGw4KOCRW-L2fso_8cqk9KR1Na07dYb6MKFu8bxXJRY7qCxklcQyVamCnxlwBzlIK6NqjSEsCh9Qb3dQDDfGoen093nTBM6nh_6JrsEcs-SyvbrNDS4DBMQlKsJODitKenysMvge98WUrXA0E_g8407ifEGplRNmQ4vjCk4kCLAf3btPIsrQ6JUOoutvhkg0C7vTLTF-3LffJu7HYk06E_A6JN5qhiP9xOSv1OtZDCvpy_-XAi0lY5iiKopDJhT0cb7qghRJOkzm9Xcb7qo-oI42aNCh_03hrp8IzqDZlLDjR4k

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://notifications.google.com/g/p/ANiao5o9MV5kZkNEgw12IoLfP85HvXVDENCIFOP8MaFjyh5ioJX7x1PPGhHwzGw4KOCRW-L2fso_8cqk9KR1Na07dYb6MKFu8bxXJRY7qCxklcQyVamCnxlwBzlIK6NqjSEsCh9Qb3dQDDfGoen093nTBM6nh_6JrsEcs-SyvbrNDS4DBMQlKsJODitKenysMvge98WUrXA0E_g8407ifEGplRNmQ4vjCk4kCLAf3btPIsrQ6JUOoutvhkg0C7vTLTF-3LffJu7HYk06E_A6JN5qhiP9xOSv1OtZDCvpy_-XAi0lY5iiKopDJhT0cb7qghRJOkzm9Xcb7qo-oI42aNCh_03hrp8IzqDZlLDjR4k

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4948	msedge.exe
4948	msedge.exe
4544	msedge.exe
4544	msedge.exe
1348	identity_helper.exe
1348	identity_helper.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4544 msedge.exe
4544 msedge.exe
4544 msedge.exe
4544 msedge.exe
4544 msedge.exe
4544 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4544 wrote to memory of 3236	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 3236	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 2876	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 4948	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 4948	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe
PID 4544 wrote to memory of 1144	4544	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://notifications.google.com/g/p/ANiao5o9MV5kZkNEgw12IoLfP85HvXVDENCIFOP8MaFjyh5ioJX7x1PPGhHwzGw4KOCRW-L2fso_8cqk9KR1Na07dYb6MKFu8bxXJRY7qCxklcQyVamCnxlwBzlIK6NqjSEsCh9Qb3dQDDfGoen093nTBM6nh_6JrsEcs-SyvbrNDS4DBMQlKsJODitKenysMvge98WUrXA0E_g8407ifEGplRNmQ4vjCk4kCLAf3btPIsrQ6JUOoutvhkg0C7vTLTF-3LffJu7HYk06E_A6JN5qhiP9xOSv1OtZDCvpy_-XAi0lY5iiKopDJhT0cb7qghRJOkzm9Xcb7qo-oI42aNCh_03hrp8IzqDZlLDjR4k
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbe0546f8,0x7ffbbe054708,0x7ffbbe054718
2⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
2⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
2⤵
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
2⤵
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
2⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
2⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1464538263325820246,9407749759305886930,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3212 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
576B

MD5
9876d45cbe832052d5a37f004a1766dd

SHA1
734f98acc21be25956aae3777fa78a5e793265dc

SHA256
5870d6b6b5662d229b17c40e44aeaf8bb91f8126a2fedb5d7ef827c2ba6f901a

SHA512
f6028bd4c111eb56a9fbe90c3e287a29c4838ab8ac9201a23eaca879e7ca16fda4f2dc875b70606f2521f46e4400f07313b9171a0998f0b1b4c527acb10d1a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
312B

MD5
8c824f55b4ed11b3179b1d3107663d68

SHA1
911c17a7fe639c05385d7f0413302b0408286af4

SHA256
df6a22a66845e0e8ce80e714226bda7cab3d19c2e2fe529d220f32248c0a9270

SHA512
e6ef2246de31f908e14a18aa8b1cdf0e8394366df1d7ea5e949d43a793b60e1e49ed2428338d08fe24a338349942a7fb45123f82ffeee558ac779094e396c6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
2ca4743acdb986459afbdcec259eca38

SHA1
115e85a1535fa1e0be8d8eb31856274351ac20a4

SHA256
89db97556745330efb75edb38a3e0efb3dd8fd3de4f5d50efc8b72955be0dca2

SHA512
dce687ad2f9c551f0edb54f3cdb3ed848346bd38d72b4bc40832b2f3435703acee30ee204eb7a27ae97963a5d09c7ceec45b06cfa02d2b3139024422fd8f64b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
dff0dde6f2fc665207b4face5778a07e

SHA1
fada2055c9ba3cab59c8035bcbf992bec9586a07

SHA256
e8560272382ab38f315f43cf9ecdb9e94c7c207f554c5cab7ee85f09c728da0c

SHA512
b96aa0a1952594d3ac41bcb8fe8f83562c6c81a1786440f4a43a53299d0c4272c90ed2d16f064111f8c2862e488e40ee1d32b3e6cb5e2445bc013c34a0f27f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c8f4ede0c6a63baa18596c1105a96159

SHA1
b79e3d6827056997210c49c9fa9a50694741d88f

SHA256
aa9b8d38d248830bf853bbc2c7a317be67fba97ecb9cc3ed6feed66890724eb9

SHA512
6e3c5f6435297dc14bda83002b2e71edce9de41d09475cf0eb6852c9f18099acddbb23a7131c1217b2a8e23b72a2aa8937e891108e6998e4c770151b587bf3b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3eeb536296796162930ce5834c7b051c

SHA1
ef2e17e07fb201e4785a2bb8c33dde9409bd1159

SHA256
5793a47df1bc58b7886b2010a588c07c02317f44340342b1afee1598605f81c2

SHA512
3e41810319be48406cd646698fc0c34a1cb88aeb44f92496a49e7a1d59669f49c3c971577338333cdf09b937c573d12c5528a8c628e09f0bbe7e8fada267ba0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
203B

MD5
48396472ba8b7e0656119e2b9db256b2

SHA1
5e50af81346580bb4968dc9e0f62155b94956417

SHA256
cacdc10959d19f52d6a712e27900a3f9c687f66067b06b895dca8be6fcc59022

SHA512
f7d51a458a5a62f747c53b5f3991aa48b481c8e7c37232787983292db785b0b50ddf2d614a62968bb0f4e1197268e80231e46b16fcbb31e01e94ee1d271a2c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
203B

MD5
f4bc62aab916c6c97eb4e90fb9a5a64d

SHA1
a36cad6b125a260480366f5574748a32bc5ecc93

SHA256
d79ac4056e739f2a36af042f7b9899621ed6822697fd3ed2d18ff6d4eabb7c4e

SHA512
a7a9b74fe319648fafcf274c3d31620a0759fb3372d489b233f17cd42af81326731d3e3aa6da4ecc637e477d985b3589ee877fc249747d7ab60cfd4cc0cb7804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c7a5.TMP
Filesize
203B

MD5
ed5884268dbb5fb29e18403117a13c87

SHA1
8c1fb48fc5b4d4c0fcac131556b9a57804e091ff

SHA256
80a65494f9bcf04ae6a97cae13de7ec843e6af2b1f1aa98fd8e4cc9622a67408

SHA512
8d2c69d1e38042e17dcbe7e24769f712a5c6d5fecfb69a5169afeaede6e909ddc5aa8420e8f23d3e052da3da9206c50aa645c8eee32194582a51ffa45f09650a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
b148b0074455d0f249a2f4ff3add1ecf

SHA1
77144f36ae390d883636084f834c35ccab3c41c7

SHA256
62653619cf6c07726c123bf39d2e11da8421868de6901dea61c9487b4c8f8add

SHA512
c35c4f05cd7f29f6cfbb48f4148a20a997dd8aaa38725c54205297fd3244f27e9e66b45aff98673fde61edbf510e525da330875ca93a93e7a08535c904669304

Download Submit
\??\pipe\LOCAL\crashpad_4544_HPASMGHZFOPFEXGU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit