hxxps://ddei5-0-ctp[.]trendmicro[.]com/wis/clicktime/v1/query?url=https%3a%2f%2fkalendar[.]ai%2fchat%2fprivate%2fMXK%2dJDPcw5c%2fOCvPtVy2iNw%3fpos%3dinvitation&umid=D6964592-1A74-0B06-A478-006D4F57D7B1&auth=b1c91733552cca54dde2549697c12b0540074366-8a35d669337eea296ce9289daf750a72c9848c92

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-fr
resource tags

arch:x64arch:x86image:win10v2004-20240508-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
10/06/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ddei5-0-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fkalendar.ai%2fchat%2fprivate%2fMXK%2dJDPcw5c%2fOCvPtVy2iNw%3fpos%3dinvitation&umid=D6964592-1A74-0B06-A478-006D4F57D7B1&auth=b1c91733552cca54dde2549697c12b0540074366-8a35d669337eea296ce9289daf750a72c9848c92

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
2052	msedge.exe
2052	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4752	2052	msedge.exe	83
PID 2052 wrote to memory of 4752	2052	msedge.exe	83
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 3076	2052	msedge.exe	84
PID 2052 wrote to memory of 5100	2052	msedge.exe	85
PID 2052 wrote to memory of 5100	2052	msedge.exe	85
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86
PID 2052 wrote to memory of 1148	2052	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ddei5-0-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fkalendar.ai%2fchat%2fprivate%2fMXK%2dJDPcw5c%2fOCvPtVy2iNw%3fpos%3dinvitation&umid=D6964592-1A74-0B06-A478-006D4F57D7B1&auth=b1c91733552cca54dde2549697c12b0540074366-8a35d669337eea296ce9289daf750a72c9848c92
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9361a46f8,0x7ff9361a4708,0x7ff9361a4718
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,12723789124945011925,2615031491884434773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
137KB

MD5
cc351dc9d0b18d2e93c107090647e212

SHA1
c32139fc363b83a9dc301b070006b28b28b89a23

SHA256
c88c6cc0333f66cdad6b0340aca85c17754707331cf47dc0e0b3cdabf2a595f9

SHA512
4bd46590c5f8d752bfdfea5a629a5a1f810fba9a9e336df90af1ce3b1fc4a1a97b91424717e36563d1a0411eeec0f19e1ef68cca3f51f6eb5dcf4be11ab6bfee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
1a9f36d8110b58aedd1072cc3faafc38

SHA1
4c0d72a93d52756c74a47952baa58135305f46e5

SHA256
eaf0b063cc0601279d78f28cc4a8f78423c3cc3c1255c49c3829e1e736e5bcb1

SHA512
537865edd1c1e98b102bb37e8c4a31f71572cc5ad2efe8afbb2c6315fa1d56da8cd5333a7f8a05de2dcf8bccc02406969e3a89c72ad104a8e7a1359d6f9e2bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
55b63bc790ab4adc5a43898a201947bc

SHA1
3106cc81ae494ca240511dd58a5fd871d1f6b71c

SHA256
ac8808cfc0f705a5ffe69a859837c90a9dbff124697d95ce3011d1f04de89293

SHA512
12a6bc7c3118c73d1167b3e20bb2c8f4320850fe94fb354fdbafdbb2b3aee934034a9d5765e5c1c37cc451edaf143ac1bd29f281b8ce7d3f5124d7b5c1330bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eca64849ec662ef99019572101d2120

SHA1
b8317f8cff6932be762e9c29729663e56bd540fb

SHA256
3e11490ef9f2cc7c521c757881cecf1693004855ea2902f83b4c57f4e87bab89

SHA512
412859a15f273b1c6ba37e3b98565e24ef33443686ee29445d162d2c24c356e55f6b40c2e08868403de7eede21cb0888cf953178b244dc7e71194cbb51e7a782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e8cdc017ea06d5dfacdeed51804e0bc9

SHA1
414e393cbd7698b104686032dc962d5bf8075c54

SHA256
5d04a3b0cf6b7fdce5379fb0030cd650c8e77383112bedff33d4f933ed7d1f18

SHA512
64ab43e872ea897dd46f7a5f82623d03d5ee2919367bfdb1f4163ae208db8f833e303ce9be67d3b48c423edb2451ef82420a8c6e294b2bf06eb68ff5f99aef35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7832e3e079adf8f72130eb6a9b2e4fe9

SHA1
7f1905df75e5a16f604c37c3f6ab2c8271f27fc6

SHA256
90859f0034f5e43a20d6a077d39644809b648531fc2a5efba029f8b57f7b1d8e

SHA512
00b137fef2a24947f4d72aa312a6f940264e29d48b930176cd5a1b163242fbbfe9bf8a291ab3b617f69f83e2c8cdf243ef20af5e12bacbd22e0caba4d3a9411d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a10424c3dade359b9344caae7f12bdd3

SHA1
23a85a4039f97280884effa4112217657365848d

SHA256
e2715c1e1f872981e965b23a36d258206460638eb50e7c98d59dd6019b34e0b1

SHA512
e64cdd35ed2d0245d631ac2bac343fdb258efebf5b6678b7b0e32bf3f828a36554724264a04afabbb503176175a9a2efa5727928752c8f8da77d549bb6a363b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2d0c8d9748c9d5121dab5efb5f31fb82

SHA1
535c64af7c32036052b105492059e506a54ceae8

SHA256
e705121aca6b61870a60a98520762a21d5b18e567e4b4839db014e6fd9a660e6

SHA512
91d5360c3ddebf48dfbef1458ddcda2757f53e231acb74ee8e6b51ee7edd28aba65229caeb89826324b68248eb607a10b3c969985736dd15556c3405a1c12c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b093.TMP

Filesize
2KB

MD5
ce869e4f429360fefae081928be42082

SHA1
c9d7ec33743f7d218f32714e43fc98d8cc084573

SHA256
ad2fd522ec9f269130133d2161ef74371d532879a1b776ad2fbb5f86b7bfbafe

SHA512
ee55569d766a257aa90c078a1c2e1e1e3ee539e9d4062bde0be21cc2dfda02fe42d59ddb6ac3d01c5c0087347913dc7eb2cc85e6a1b2c8fff298b28ed7f25828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2f220ebfb50bedcd807528e414605461

SHA1
c12105b1dd5103083439e8465553c50bb8bc24ab

SHA256
55d0cff1409c7ebc8842244fac078da71de9cd45467da1dabdd3b0ee2dd1b274

SHA512
409705de712d3b5ca226dfad26aa33a43268b5b0e7d397c24cae8d2acaeefc4049c6825cf0a9b8ff9b899e817b2d944162382439949f0f212c0c8058a924cb2e

Download Submit