hxxps://go-link[.]ru/orONn

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go-link.ru/orONn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4460	msedge.exe
4460	msedge.exe
1596	msedge.exe
1596	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1596 msedge.exe
1596 msedge.exe
1596 msedge.exe
1596 msedge.exe
1596 msedge.exe
1596 msedge.exe
1596 msedge.exe
1596 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1596 wrote to memory of 4508	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 4508	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 3408	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 4460	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 4460	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe
PID 1596 wrote to memory of 2328	1596	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/orONn
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9406b46f8,0x7ff9406b4708,0x7ff9406b4718
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
2⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
2⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
2⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
2⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5932 /prefetch:8
2⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4240 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2796939141709433845,3930984400081795800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
2⤵
PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
d5725a049a5ce24c9c5e69a57b4b80e3

SHA1
259e582024e06976ced84d8addbbb1e90de8197e

SHA256
4fe269763e7ef84ea92d2a8fabe091c429bffc855ce3bb8bd5146acd9d36ff7e

SHA512
047079b7a0099789c44929b924c6cad6bb7ce27510de7c5c23eebbe901baa7c1ce264f0346cdb647227003e941e44fbacbcfba412c87d8b4a7fb6375be158e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
8698193c2ff6a6fa134a524336fc4655

SHA1
f8058a123c956301fef952c900a88fee84ef518c

SHA256
fc50c745398b44ab17ce4b401f43a7b8c7e2429858a62c5f23c2d0daf54d8d3e

SHA512
6ce13b1eb24daa3fdafd579411627e717db2c0d1cc92fa8b4cc33ceef1f191f9d7b7d238ea274f48d469259c0e68d24ad4fe6f9735414d9784238c4627cb4c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
a62736d6a29dce781299b1e153ce99b1

SHA1
24651a1f8398a7818942c436a34d3f8cf208853b

SHA256
50f4bdea8e30efce82c9c711ff7ad3794eb38e5ce1e76fe9b38922f309212717

SHA512
8e98e6bf20664c853164b6d62df62908ed00619eee8e223d2da7456c92fa7ce83beabd2853f522a1f805f6d2fc8dea72783b4feb6ea312dbd59b1d0f7dd6edb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
edd4551731726939d801e97073a4a7f9

SHA1
7d9acd131caf3fc2f816d623333dfc57df233efd

SHA256
abf26b16954cb4f314b988fcec74d368626204f16f077b24ead13fef4e06ada1

SHA512
41d303b3ceaa9a3b1b5d8374d219aa3a77ad0bac5c3612a7c59decbc6851548092fb64b38d3086aaf4fadd9686a3d065b0c52a6bc38a7081831b6e421a1be9f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e08b9f331b80313a06825f7ad65cac7b

SHA1
2552c3bfa607b0c2e5c287596c0ba30b1ec932f4

SHA256
099883187f6669559e55570260f2d0e68f3783ef49522d71201d5e5045338567

SHA512
1efc84e5054588088786d5defcdad95c307416364325fbd3ebda0185b55d93a037699afdf2ce9101db60894cf118cecbdb99e7e8ae21ce53f6949ea159fcf905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4fe77825768229e1a6102d81a88551e

SHA1
ee400aa97a60b8aa77a5f06df6ef6c2e5e5dacf5

SHA256
feda45eecdc6a17753ea4359c1cef1e3fcb3ec14fec81d87a3ecf52c27f3f1c4

SHA512
215fd04ea0bfb5e9e9cb0444ade58e65075944e84b25dc0363fe27d73c226a4896e06a34b7d64bfe901bf005b936d08453b163d9a3b5b021ce7b29a2265f01b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1de30c307e03c97972a930bca23fd85

SHA1
98b6a6c6287242360d8316b84b38a391592b489d

SHA256
72ea6c04aca27805c40eba3fae00a92109c68f278dc8ce82028c08b90069a987

SHA512
bfc4c22c7e2c6fb88e817e37459df16826cef0636f713238d3000bdd9885026f69b07149bf7a508f45f410bcaa44318c20284da755ff5efbe9994f7fccbff722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2cbaa0f363bc563b50993aa8748d85f

SHA1
ec24e18106d82589e81e197b374efab846db8d4c

SHA256
cb7dba52d69d741df81d8a6eb4a3dbb294261bcfc29ce2704fe55a0eec82783c

SHA512
2ad936375b5b8cd368ffba1451be5bb78b9bbfa4f6d8a85a654dd681a789a36e8209a846aae1b9a0b06f22415b411618fda76b23206567b4a8c5328121e5dd03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef201c097280395edd36bd59784a710c

SHA1
14487a64431fdebe801830020bc6df7bdd69d870

SHA256
42b4dbf635bbe09de8071c7f6892393e5acb84db049d91f3c3114e27ca3a83a1

SHA512
079ad1494fec0eb34f350e803d19be15fa53d4457a5e7f22836dc21eada358618878a0c02bd777469846385a433fc418cada372acb26217427e74d0ccabec594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f9d93c0128732be9886e64f5439466b

SHA1
e6fde24d86afe647bdaaf51d00f651522cc61743

SHA256
50d5da0d0ba130db5bc3c85be53751b83d1cefc0836be97dea90d03db898151c

SHA512
4228e271eb784d83bee89f0f380d5880b1411cd6566769bc0e9fa92ce96b55406631d3838c3df4743d9cafa56ae1fa061da494a4107247be2a8b070e07e23742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
15443d90134b74b834e649c7f6c3407a

SHA1
9d550e87b36d16e350fbc4f23b35222592e07381

SHA256
092fbac75552ee1028429d07590584ca0999a69bcf3a3b9c3658409ebd9ebbda

SHA512
56611abb01c3adc1ca46dc9b2080c75ac02606db5db9cb0f9eadc9e3bcd2ff5d60adf75d6d0bf7a98c605278ec22e4a00f2c9fb0537404b1a9f37b8be87a5740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596ad6.TMP

Filesize
539B

MD5
150435cbf21206f234f01acade71b86a

SHA1
a36fbd4003b5c25196b911e503381367fd4bbad3

SHA256
767ac0d757948f8d90d5687a211b01edcfe1133edf278cb388dc4e1285e4946e

SHA512
4fd1677e1c15043858562eefb5a8fe95aa990e0c0f284eb322024390d8a127c6e6287e2346cf7a55b0f44105162befdba1285eaa50c8265ee2ecbb09260731ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa743d4e65268611dc3864a5e391475d

SHA1
1f96d1def8371787596fc739893a4a1fbc758c58

SHA256
35107d288ab34b6e15d576d74f35e205c5ab7e36e4d0dc9ff738c46100c041e1

SHA512
a4f182204e8cbb231db1627f03a3d9c28415f729bd3b48db5ce1021f7c4d6c26a36e3868bfed8e793082beca5db44ba194ec79c42f442894730d2a66005f0a47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_1596_UMXUTZVKBVVXACSZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit