hxxps://github[.]com/kindawindytoday

Analysis

max time kernel
205s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kindawindytoday

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	launcher.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
3656	msedge.exe
3656	msedge.exe
2560	identity_helper.exe
2560	identity_helper.exe
2092	msedge.exe
2092	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1532	OpenWith.exe
3568	launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3568	launcher.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1532	OpenWith.exe
3568	launcher.exe
3568	launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3536	3656	msedge.exe	68
PID 3656 wrote to memory of 3536	3656	msedge.exe	68
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 2936	3656	msedge.exe	85
PID 3656 wrote to memory of 4940	3656	msedge.exe	86
PID 3656 wrote to memory of 4940	3656	msedge.exe	86
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87
PID 3656 wrote to memory of 552	3656	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/kindawindytoday
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6aa646f8,0x7ffc6aa64708,0x7ffc6aa64718
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4340828900628580312,4382322627502516006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Users\Admin\Downloads\minty\launcher.exe
"C:\Users\Admin\Downloads\minty\launcher.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58670ac03d80eb4bd1cec7ac5672d2e8

SHA1
276295d2f9e58fb0b8ef03bd9567227fb94e03f7

SHA256
76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

SHA512
99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3782686f747f4a85739b170a3898b645

SHA1
81ae1c4fd3d1fddb50b3773e66439367788c219c

SHA256
67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

SHA512
54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
34fb36e9eb4af882e3b1d23a2a69da00

SHA1
46ed32bfdcccff69d64f0010a2ecc86a54422032

SHA256
edcecc4d275ab6be913058867c3ace15ac612c0a89eb2694ae539ce0c6ad68a0

SHA512
2a13158fc18c2a7621565717194a8b335f7aafd9a3a2c06ada1d5658930fc1a8e0a22a9ea9ce2d11eff41ab35fde291e4d122104c5de079d6eed3c69a9b034c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
34a72154ed9746a609b29d25ad8d6469

SHA1
ee1fc6413972b90af4973bc1c158c47011e757b5

SHA256
629a1e55ae58d7e9e13caf2aabc58ad73415b514df679a5e15ac561b1b549f10

SHA512
2789dcc6843a73666ed06d51a7bfb8e92dd7c0a82062dc0d252d883e4c943fc229932fdb1410e9d40d7a7dd965623f3df582640a0952adf7feb7e05a68e37d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7e61e2d78e74272d5b5acaa2910e3c2

SHA1
d5cfc5de86067312ced494dd77da496ffdb8cdf9

SHA256
8ec5f660f9c526e24960ddbf05e6e28c9cbcd0a61f94e3f6352bd902e1655de0

SHA512
9758cbcfff645140b6645b193eb6e65aada545692da957901fd031d3ad5627d7c54828a7c3c3d2897adab794db2bcd27c14fa90249213932b516b39f40f7ce4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c2ac6a77cc7840e8de3fba5ae639714

SHA1
3e50692c9025a38e27978cd40bfdfa9295dff975

SHA256
557fafeea165c1e7f857a57bff52491c5de33376512770ae0e1d1f7f6336d309

SHA512
d9853dc190c19fdd8e397181124a9771893eb7b44e92e11e93cb92f713dceb774ed4edf1dc7e6fbcaef291e4ae00ffe6cb615c4f0b3f02ce0fd9c33a7c4691d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
858788627b7d12086796101ce23288e8

SHA1
d3cb5abaeee1911f6d3ad52302033029ff9ec1d5

SHA256
7e544fcecca2fdeba4d186cff47d74dc69b74bd63aba1fbe775ac505b8d24601

SHA512
feb4a5201bc0e2fe4f26c8c510b5ffa4494c9242397c8e3ade2353eed9581823468f94a8503c92627f5bb06455fe13ab95b456849614c68e11fdc2b6df60f35f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
cb7e197e337cce0e3c2b859de387b93b

SHA1
5ca4bdfcf15926d2c08061f32c003690e0195d15

SHA256
5b0b5c4b11c47d121789a8fa4a59d62fb5d15fc6aa5cc6e27a788800031af3a8

SHA512
78fb3046e92c43ea338913aaf4ec96e0f883ada50a4034891356067267ee144d19139ea88ce6333f35baa12fb6153011ab6ee370cc27b0083c3ef55f42369e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b2a6.TMP

Filesize
874B

MD5
cf73318ffb81ce4ca9cb731743e2ceb5

SHA1
9284327ec6a0cd840af655f84801478bdd945336

SHA256
df097818a34e5c6688195d570aa422e0c4078656efdf8e39fc12749c325e7f61

SHA512
9b8920886716f5ad8cc483e2b0e9263afb7bafab52826d620ba18ebc47c2e39896a33e97db70de7615d9c4ba5b591685406a87d92a46358a5cce0808cfaab260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f949ee88faaddce4ff8c22e901ddd20d

SHA1
1edbb408d13ca4576f33d27e67be4632a7f75cc1

SHA256
fe3716b18b09b5b3e8ac4a56f46e5453066757e7a3df8d78df77133bafa8ea15

SHA512
85724fadf1277a3c759fb1c53bba506051fde3fef9079045dd42361345bbc0fccd1f73608aab0ba13eecbd9e3a7540d4d4fdeed62b237e52d925f8db406d6902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
20d28f1b6e8b3a1b877db396affabf61

SHA1
2b55663da573530c9926ff9575b7e64bec7d6074

SHA256
8c45aaa88c3eb3788e884d95a20bd23b6682fed62eb7de71b7469b97ecb2e100

SHA512
63f602cd779e640592c160dfd8fb16deb7ec719f74a32e56dfab12d64b77bb52086e341768243b8b5b58080eaf89b04891004d3cfb3f8feb1a49bc15eda85c9a

Download Submit
C:\Users\Admin\Downloads\minty.zip

Filesize
668KB

MD5
6d94892eaa9f8ce9a64e2f5ac153e86c

SHA1
3f190a851a31bb800ee3590bee28490d4bf47a1a

SHA256
90e781f5f3b15c19bf976fedc8c4214a58701e75b7911d27289b75b3fa945093

SHA512
7bf6f850b6163d54b929cfd8d6bf43491d287a8f7eebaad30e557e3a54cf748373e8e9536e8b1008c8de59eb98ed987d644a58af90ad241c52212ec9f4cd4d82

Download Submit