hxxp://shorter[.]me/7BfW7

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-it
resource tags

arch:x64arch:x86image:win10v2004-20231215-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
18-02-2024 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://shorter.me/7BfW7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1920	msedge.exe
1920	msedge.exe
1548	msedge.exe
1548	msedge.exe
1076	identity_helper.exe
1076	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1548 wrote to memory of 1628	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 1628	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4388	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 1920	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 1920	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe
PID 1548 wrote to memory of 4304	1548	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://shorter.me/7BfW7
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaadc046f8,0x7ffaadc04708,0x7ffaadc04718
2⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
2⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
2⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
2⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
2⤵
PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
2⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
2⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
2⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
2⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
2⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
2⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10657579778869113827,2118258307814549498,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
672B

MD5
c49f33d2f86ab26cc0f8a6fcafce12a4

SHA1
d148267c89063ebe5d26982c09d91d87f3925100

SHA256
8373e5a26242685ea043ea8eca0d574306567a496fcd87842af4289bb3a947d2

SHA512
47e9ab84659b9b887b1605435116b683f31607d20e78ba4bc38091ecc63bcf9a67f233c3a6bee0aed6abb4a70ff9aa8f94b71c7beb458f5d791160eb0b964e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
f2ea2550dbddcb28105f1861d2ae69f7

SHA1
1eb7609d33eda0f5ad3309b2f872f91dc2a746d3

SHA256
fbab311eeae7ac4dd8df31b9e138d69d655c666f29c7cd91e17b4f8e5603dcdc

SHA512
8b915f6ef3f019fc2feb3b4bf644e25fd37e29d772ca64a4afe1d213ff2d3c01282c6207598e939e6a018ad7bbab4f50324c4612ae24cd707ad8893aabaa4cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
373a04d6818fe6ae7bf6e3042c5c2d3d

SHA1
54f85f6df66664f11a0492effd388470a66a8298

SHA256
77f0201658ecaa04aba3233f5ff52a3a34fd4061e88b5b9aba9bfdeaad59f382

SHA512
d24786474858a77d9479c1e76dd46f2827905c11500fea4f23716941ea16e44ae88400888fa201e60b1d5e9988e6f8ce4c723ed4414c4a056c1a819a04dea864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dea1d5eabcf7bab45f5e446a4c674e31

SHA1
a395834206bf3cc52b179042dde86b9a48dbf67e

SHA256
59d7d1353c8147c33c1fda68743d900a9e36971cf6e00306211310615548a1b8

SHA512
8de099477e8c476d5ff4c76f1156145a0583031b03aa43cad72dea73adefb3b9f475d4c239657b3d4114e69d64642bbf25432763fb38be73ab50d74c5ceb1fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1bf71e8d10cba2ba080b63a57419f9a

SHA1
169dbd8341f2c31a7de2a5276332cc09e1f8be83

SHA256
ce6748bdb06ae49018b2eae556a539f33e1ff1bc63ef0cf97f254afc28cd12ae

SHA512
abef8d55565a6a0511a4bc5d323b2916a3485263c93655d1e0b58ecd8f82afd46ca647fab4121866fbe47ca8110e9933ea369b4b4dc97f3cd26c373a74ccab05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
db6ba467290ff938beba606fca514106

SHA1
c8ad5a41c124b041fa4d34bb6ab17170912c5243

SHA256
786ebcaf34b8c75a2b4dbe20badad738056df55ade4f0d2893cbee997286fb01

SHA512
8a02d633e30d5fb8456882a1773733bbeb70086c873a09bdae5d7665c6562ad317df79dd7ca978ac8cb404eca1bbbff22544b3fe9aab1b8ba6d09f065249542c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f07a7cf061f99806d7609e1d5d5162f

SHA1
96279897a7d293abd5ece70cd16ab4f5cc9de6c7

SHA256
d51ca9989b072ba4cc6bacb7f2dbfe723456bd297e45fca0fcf895f2e5d8e846

SHA512
24f21518337e8e05d15bf90c1d05ef9a520d2df752cb5db92b16f02beef6fb347d2cb2e0ea01278b1f6441434c869c9bedf0150df9b5c3ee5c3ea773049e0f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bb85f0824b23152d77e14986d320ab5d

SHA1
06ca38d0a35764a075b20b2238171776b0ce4313

SHA256
0f9a7fafb837dfc10978cb4468de86e9ad1ae8056593b11453df1b4cf6c6a8ff

SHA512
6e26932b392f227277c9b94c64cfcd723ee97eb6baef54d7e1420d0d089da91a5bcd0b12ee9481574067c9e3954f254a89b1aa0ba3dbccca4f3b27e1ee286a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
fdb34b4fa1930045f2d025056a98b5f2

SHA1
c2e817ab90918c23f446fc0457d5100fc8a21c95

SHA256
fc3701d0d383f448407d59fe247449f5f606fc2141e9ba94663b77f812f8289b

SHA512
6551082cea44b1bb80409b0c30ad068ff0012aca32dfd155777556a77fba34bc465c679857b617783dc0395abf0f5b77faa544f0b6c5d444ac285dfc5a7d6777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5883e1.TMP

Filesize
705B

MD5
285229c5be408f4f69e85cc1f3637df6

SHA1
a96d6452af0de14bcf97bd7ec9a49ea4548cdb21

SHA256
242671671186c00349756b7f8c08b0fea794860ccf5e691a90a425fbe7faa18f

SHA512
0f068d1639e3f44600a3dff665df6903ee04adc89823ce749fb5bf925d82432cf7ad4f9f7363fafa75327d73d29ae6fcd8f9fcc2aec06cfef2729fcb7c1544fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
af4c57fe422fd2d8940ef47643bb3493

SHA1
8c7d1c77ead6280c5810e073837344c795c226b7

SHA256
8200df094248efe570300e700bc60a7f92b5d419376f491559e3f869375a2e07

SHA512
dba4172749740516d683fc777de17c0467e7d6becccdb8cd7d44c72a9cde1a357379574019f585da36a7d272305ed15c70fced9c26d0028ebc7b01a2db1c32b9

Download Submit
\??\pipe\LOCAL\crashpad_1548_DGRGRJPIJXHJOWPZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit