hxxps://r2beeaton[.]con/t/

Analysis

max time kernel
115s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r2beeaton.con/t/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
3424	msedge.exe
3424	msedge.exe
4852	identity_helper.exe
4852	identity_helper.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4316	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4560	3424	msedge.exe	85
PID 3424 wrote to memory of 4560	3424	msedge.exe	85
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 5016	3424	msedge.exe	86
PID 3424 wrote to memory of 2804	3424	msedge.exe	87
PID 3424 wrote to memory of 2804	3424	msedge.exe	87
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88
PID 3424 wrote to memory of 4536	3424	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://r2beeaton.con/t/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cfbf46f8,0x7ff9cfbf4708,0x7ff9cfbf4718
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,7031210316609798084,2629078694896050821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x4ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ac0f20d-14ac-45fb-964c-0a914708a905.tmp

Filesize
11KB

MD5
5ff1e8ecae1d74ad1b604f9619b16f9e

SHA1
6254e6f63abab060d3f523accb3e6925d2ab91c4

SHA256
93b9d2c2798cea2c0dbb78ef782cc08941043656bc90f738ea8d19ba4d869d55

SHA512
5b9bbcd5112f50eda11518419bb158094b4fa90ffa2bc38e3cac1db86501972ab4b1ee956d8970a0fae6a9ca1d5b5ec05a557d9d2382f1da14738fa5f81dd3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d9da931f98579d9af12b0cddeea667a

SHA1
5f02b023ce6b879af428b39ce9573f2343ef4771

SHA256
ae100e49b8a80ae8b977141fca8c9d0b35112f92af89ebe4dc5dbf2b1311fff0

SHA512
bd338bf14893d2c2f529eb0542b6b82e2beed5614d449c4147a87067f6ba1ff8d7bb178ad56d7b1491acd9d08d5bac5d1906160cf14998a13957117967a28680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e95d45b99ee46b05441be74a152f3af8

SHA1
76adb523ca3943c8eeb4793a7daaa1f27cbab7d4

SHA256
435d76228edca3be83910f980b82f508e25541918fc3d7c4278a77307c880fb0

SHA512
35ec6bb16d0aba61622e6c9c8d1d4823b8d3e13644ab0b849cace25e0ed2adcf3cd98f6e7e7a24be8c64e360ea3be71523ed12d3c061d88eaa24276bfd91da80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6cd04a16c905a1f0c7342952013f5e1d

SHA1
4118563b3dccaf5f94eaaa394722ab30e50f0338

SHA256
57d3b139567c3de838c6b7e074745c27f200cf4825641124053c7f2ab944f16e

SHA512
723c01c228fd7cfe0ed3ec698513368ed2e4c54ca2fa76e3efdbc751186e2ba90ebbdb92af4b173acdb329f1b1cbc3efa564ba8a05d01c852a1a5c86f0b52379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6bf56d556a62f54f4d29005eb86bd491

SHA1
f5363d62c122a95b9c402557731af7393b9083f2

SHA256
c544fdeb6c9d18ea7185a95bf3670491a453488271000f1f2e6d982ce4db6bc6

SHA512
df034be1fafbc3086a12cc0c17775d5b349faedf3f126b295bae8bc0487448c8a544e0dfabeac5f3060bca7962eed92f3f2b472dbf26a2ae1c294c19789b84f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
58e7d1fc0ae5963fcc4032cf67690fbd

SHA1
3b1622c1ad2ac533aeede00b9741cd75aa194cb7

SHA256
7d7b999346db8a738893742b87ea883abfa4c321adab6ea5875021272bbfa813

SHA512
c848db813103affb893ed330edc2058448c0d302be0616e25f4ae183a56c278517f4004a3ce5984d8ddcb2f29a870c3a175891b21028883dc7105071a5ab0457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
2932dc8aafbf2a7a1dba41099ca52e4d

SHA1
0b8ad2fd72e88f8a17ed7c9f4dc123c08c228748

SHA256
52b6297a82a20a46a3eba1040e2b3b9f9d8b8ce570ddbba9431ab1693a04e009

SHA512
c9e8de29affa0170de99a474ab258a3ea57dbd552a950b02d77d6d829c30d6c6a2ac6db357521bf52f3b624efbf29850e520807f88113b7b336673e42dae2596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2db0deeac4dcc98f1bc3e885328d596

SHA1
d7f4954ac9c2648060e707243a5d25e2339da0ee

SHA256
3428dddf79fbcccb88f25288df675b767b8efdba67a8b6112173997386a2d14c

SHA512
b9589b7b829c4d37f675fef6e46d9f192ef3ca2e7de64daf80c40371b31972fd6ee5666a95808de6216cc081a599ee887814b24eb5c60a62b8b2d4c8eea147fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
11e2a1e7356481f413a16014b1a8e05a

SHA1
63af049b8883c1697d2b395fe37e359624637cfc

SHA256
3f42503c2529de3a0bcff82f3d95579ec81f27772139bc96296db63e0d6a7058

SHA512
4f9262c411099d27dff993ec6fe2aa16fb43bee2f455e7965a2bd213e6d86610ddd7ac266707878dd167198fcbf6c62dac390c087644c7b94d3e3e91251a82c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
91988ac7df8dc66ba272c0cbeafbf7cc

SHA1
588cdcc5d6bd20d58dccddd21a5c93db18f74b37

SHA256
273d73d4c58a6987d4e4872942e85b2d1caf900fb27bcd9fee9e230e735caf7a

SHA512
ed155c50d5c936d1e5ff453119c87da1a03d66889cd30b12a40114eed944c4af0e73780785178e89effb301dce398af43a6addea4d0ac73b7e3d3d40c7f4554e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afe45a72d69bfebbc869adda6515d09c

SHA1
346f031d1f88396fc7d7e9bb65205d39c36e0be0

SHA256
3385eda9ce2c1942f3fa1aea6be818cad94ef92b65e353d7e98eeaa5434e8221

SHA512
dbe5510455a8f1616c70adff45700e449a562b28becf8bf8826ef05558a68ebd12e6182d0794688aab4f081e2aea6fd07bb76e9ab4fde9dc789a82810c2f5878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee1d59dee2d3b6a1426a996e42159f6a

SHA1
a2bf0b4fb9eef245d41b377ce5ed61d68b9241d4

SHA256
416c80d14eb1e8f41c82a1cfb756b6352572e81b7242692d8ac5a90e25b8b414

SHA512
e38220dc3498d05045faf5e08a3193b77e82684ad3d9ed7557e4400d74a1e29009d45c0d125c41b3b7df415d039dca2dc42e340bbe24e6c742fa0771e3268901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc35074c81100d68ceb8db3822ecca80

SHA1
b28c89b64b55eec4247e4298816571df244361c1

SHA256
61a59b538827bd12d1fa89330b31de1dc3a5b9071438f9f53b0f477460714863

SHA512
717a1e965173a334b581f0f75ebb7df07c8e5ad43eb96a9265ef40260289397043b68cf8c1afd6e6f630725a426e2b7b0f8da94a98d6fc735e742ba201b6e12d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
07705f78227b976fb50bb5f9659bd1e2

SHA1
39e2154c7224212794f205a749808e13191c3173

SHA256
29a51b3a77c34e03aa3019747504b5e4faa9b9c6e1bfa198c3be1a395818c78b

SHA512
8fc91feea3eafd540d2bc10e1e3cd242c249d88fec17a314733bed99e245e3b0a8990418e0053379395987171d38d8545c05f33a3bdd2241a8f70b5cdd4b481a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
576e83c1432aa0b2a97b98e1e603ee45

SHA1
b8ac02412b03cf249f4943bbd85ebbd85f3a8889

SHA256
a14ba96dfa9b38b9981de1b12529c08bc3e884cb7ecae60f6a3c5418dafd736e

SHA512
3c763bdcccfdf9415cbec63269cf3d88666ed9231143cb002f813ebbcf0d8e2d21d87e179c37bd9f2d35dd0abfe8b9f018ba81c2e1b01699cfc5a8d6f9139266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
670aabb3e6f6abbe07e6527de1a56723

SHA1
fba98ffd66f27a44e71188cb899f406b2ad44b11

SHA256
00779aa35080a25371c8b3a733833ce97947753048dd39174c850fb436da2ac1

SHA512
cb65c101e6aed940e4dc20a09c66ac7012c5b50b42d294f94bcf98733b192c82a80f581d5dc94a55f259ccfd0387d99ddf4d62b89d6cf12e0b9b9cd67bf08d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b1eaf976e96691141d0d9a3ae43ffe23

SHA1
7b7aad1739594a1f49e6b43357bbf5afab708034

SHA256
310921f2ea7e1da496d079eaa6689185d2c610a1fb1591591ac615ff551b3a76

SHA512
0b243948608c4c08c111471304fcfc06835fc3eb450a40d69644bb1a083ef95a6af8410034af8d35793d4d8f1739423b971481ac80eb1b00c93ee127105daff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a819195ce7dd2f03eae1db7a853ee90d

SHA1
6df7391cd3994b8426bb9595e6d42729b3663342

SHA256
db9bd5396c35e461bd3bcef19f9964a743e62a2d369b968abde61964edd81e66

SHA512
a2127181a5fcdfb3d1a936205333f3fa7dd0f248914e38bfc8a3a3846ae93c9cf58f626ef7706b1dd2cd70cdbea7ceb5f607b15e9386e9b6ea029ba8382cdf85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
305e235674577dda5787f6bdd381a785

SHA1
6fe051cccc0790575306900efac8e7297650b891

SHA256
30a9a0672017ac10292e32b5edeffa04252c0f397a58bf85bd954fb916c4bc2f

SHA512
7670dc40de6cfad552735a5b4d64cc09c4237ec94d9b8d7982c442060877e741740b09eb80005daf5a123b8e56f14aecbfde0e6987d98dc3a22e1250985a7bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587f9b.TMP

Filesize
706B

MD5
2ae6553f2a9f0a47147a2a74503b1b2e

SHA1
5bb0bfbfa0dd95af23bd0c28d4c1c02924bbe34f

SHA256
3fda54a8d7d168bf8a89617684532c4d5d691ca5943421cd07dd4da020630bc4

SHA512
4b90c3d64ab5fa359a5549a23e943987e73946a5470951d1724ef5e7c379649a8bc81ea249c34d286cf85e01ec9ad0efb716f20a10f6656719cea83d1524b824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0342595a917c9e573ec884e22599b6dc

SHA1
13c0953e8be7514ad3ca504ddedb7476188cd818

SHA256
eebb021866fcc714b69b580f9a4847c5ed503cf4f667ab79497dbcb0180f3b6d

SHA512
0b5baabc38860712208bea0488033b38bcd53bbbcde382197d5f47f32ab6adfdf0333c785a3c2cf375584e953d3c2f164f58bf4eacac17bd5f4864fb3f93d24d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
13KB

MD5
0e7ed078b18b9cac71f0d1268a48b3e9

SHA1
a85b935cc5336de8d001068cb1d504a32ff0cf85

SHA256
9fab52bf26f5478ac0abeac13ecb4b1b22a52a6f56084eef472b3f42143a3b64

SHA512
85f324456b79bede477766e4964dec59db92e02e163ecef2de26cd717f48c5e75a351016bd48d77e8e36869ad61164e066f0c71e3948a7a6c69e466f34925f1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
4fc60335b53702234a889272d4670780

SHA1
837fd15a2be08b7b106824061b36280886dc6084

SHA256
4b4a562d9eb1c620e9766e6bdaadc02dfae3d35386bb8d74a96e05dcbf9fbe25

SHA512
f93d37a29f34f47700ae327c114f148ad4944054e08922eb3a55bb7740a05fb207d3438fb75c0bd786aca7a0efb70a06180ea6aa8f9354e7a1b61aac4b0632d0

Download Submit