hxxps://tr[.]ee/RnpctcSyyx

Analysis

max time kernel
1764s
max time network
1773s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tr.ee/RnpctcSyyx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
2780	msedge.exe
2780	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
5900	msedge.exe
5900	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1752	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1616	2780	msedge.exe	83
PID 2780 wrote to memory of 1616	2780	msedge.exe	83
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 3520	2780	msedge.exe	85
PID 2780 wrote to memory of 1992	2780	msedge.exe	86
PID 2780 wrote to memory of 1992	2780	msedge.exe	86
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87
PID 2780 wrote to memory of 2184	2780	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tr.ee/RnpctcSyyx
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3bd946f8,0x7ffe3bd94708,0x7ffe3bd94718
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8829056130262077911,12456109710521497482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
3b527c0251ccd1ac72e87eac7ff1d90f

SHA1
92253428b8e3eb263fdd2835583f91f88d0cf160

SHA256
fbfcd874f1d4bca14b48c09a3da729323d6e34a4e8798df811bb084ed4b93b3e

SHA512
94e4cbf91a0d37d42a8a8a3ec37bbc8b87434c3b59242fe03051a85f7891379ea888d7fe5430f7995bfb56c9b03491416be6e7ed675731c0fc20a08d2525301d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
260ca0337f5793f26f26ab6605429c7a

SHA1
1b46dcab6b5505edcf9e70a82c6f974217ab6d66

SHA256
51d106e279580ebf8208739db22504b0a70063151214d3b7c5575e62ad033151

SHA512
6e92c00e7dfac25b297811a10c2837f4d13d4a8db9228928a60531f1f0121edd417897159940dafd52f1df4bbe303f30f1d4a9a9a4eeaa7f4b712f1049e8ad3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57551d01d5690bb37ee2ac54546b0295

SHA1
3263061205f8cab6947b088da793e0ec8091d52d

SHA256
5aa87bd438eeb998822f21ef2f3037bd00e215efcff14080a5c472ead678cc48

SHA512
8bf80122d368057d79a548e2210e88cdde0f5e726afa5c794cd9f8dc1ca336707ac498c006fb48649f4ee615af34e5b8683834c42a9c9a631929d0aedffd8de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f361d5acb83c7e1a0a81818ea2ade593

SHA1
69a6a89742e91ddcc90a83b44663378195d18908

SHA256
6c0af961a020ca33d316ca9171afaa56a49dc126f776c5c06d48f2868f0a477f

SHA512
11f8fe67af2e0a37fdef51c0d99cf02995bc0698ea165955bfebe81a31474444a7cc0e2ec93c7bfecd72305a12055e74992c126d7c1107fe442f690b9c940d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8069c576fd5456e784bc8fb64b48c748

SHA1
728c33b820891737e18275f4277ea0b48ff2ec88

SHA256
2e60299dcae80cabc12fce31d78e28497896dc0ee58af1d9b99efd85b2808cd4

SHA512
c9bcc0c532b3500c0efa582099e64b1a39d6e5081835bab7b45d0c126dbb935e022e56262a6fd92551df1d357159e122d40c448bfe9cddc418f2fdd0f99f9c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d3cb3649419034c38a3b108c1f3f5941

SHA1
d512b14b49bfd59d2b3bfc9f6791da9595569147

SHA256
daecde3fd1abf64d1bcfbb5e1aea43fcd98f149b20e719614e4cbf3ee5175805

SHA512
354486c58255dcdea04b1b5c86e96408a78883bb71f131df1b7adf3d2ab1dead62bd0c37e5e42d5a108bb9a6faa44ca6b7b48a6e26089bdcff710876aaa2daa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579db7.TMP

Filesize
48B

MD5
6517175e5c810b1dd8b03669acd2a0c6

SHA1
dfef28315c2395b311679ceae99ff81e72aa1b24

SHA256
30ffb4cedaa7f8e6be474a593adb5d9b76f76735176a215ef462f6089c722a86

SHA512
62cdfb3d410f13acffb1ce6747bcc5cb691a0aa82094c0baebf3dfaa317fce0ee300f6df41086386f26d8ba60c16bf6cbab3e7984ea6eec99e53cced652239b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d1869aacba13e37090910bb8cb98be6

SHA1
35f3612bb1fec46d86f61949deaf0ccbae14cc89

SHA256
6963b63553658f2431b6d17de80573c443dfc3b0cd2a1a1b6ae50dfcf27a909a

SHA512
1f899dae60d9fe60ec55224549f86043e5477a9230ab10a45ac1235e381509bb297ecd5b4c8bca6e4e3a49762d7eb19ad35bb8cdaf1b7f751579056f1c966545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e937.TMP

Filesize
1KB

MD5
3a275554837d7697b8430ebf250b7cec

SHA1
3671a1e7b195f28e62126e8d6bc91fa503a3ddc4

SHA256
57979e775bb6eb4b8ea3a932dc88fed9b28fe4d8e92f4b97cff50588f2c4bb72

SHA512
1d41b4356470c278576fa9fdf3d84779e2b92b1aedcddcd0ce49b33d844038fad5665097d250dd85970405f8e49bfc65ce78327319e62f3ed37989e662bc4127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90d7c99f69d5d11494afab5862f5f6e5

SHA1
4a0730dbcdc04c717b327ff5fbf5bfdf2d3b5165

SHA256
25f1c01e2ed1e653face6ea78fcf06cfe6745121bd2e4e2e41c92a5bf5a499d7

SHA512
4ca38a5a7214f8fa76de20a92c314d2ce3a8d3c9fbf7e97b89df1c84f2a256c2a7bd72023c85f7fad9452efbbd16c900bf92d8de7a2c173fcce00e7e9d71995e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dfe8db8128ee9c6580e8bf88e9173d4f

SHA1
490a1c8d13ddd2d4c79e0b4572c5d0a4d16f2f4e

SHA256
0e7d068e542041b0c7e5b113089d664796a4cce9fcdc9829ccae89f6a97d4491

SHA512
1ed676a3f08359876c59df499ded3ee35bee42e8ae228f32d740770be6a1651cf87cee2927fb0ae16baf72f291a8cfdaa74d440d892f33215b0a623708e51bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f666e252abffb4795ac965a6a7195acb

SHA1
73c05e145acc0083cd31a0c43fd387994a060bbc

SHA256
fb1a3afc3e72a9d8d37f276d41a1efac4effeaf36f05f9b1a8a69e6eb5035607

SHA512
4e6b04d57413c1b2222aae7bab46b1f2745b212aa70d29f6c10c0d12c5be1c7eef0ac7297985444332d82e5bc72a4a58108f9188bf77205d75a7e2a37d4a5ffe

Download Submit