hxxps://sc[.]link/KVXSx

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sc.link/KVXSx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2360	msedge.exe
2360	msedge.exe
4492	msedge.exe
4492	msedge.exe
2140	identity_helper.exe
2140	identity_helper.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4492 wrote to memory of 1324	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 1324	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 4636	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 2360	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 2360	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe
PID 4492 wrote to memory of 3848	4492	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sc.link/KVXSx
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e77d46f8,0x7ff9e77d4708,0x7ff9e77d4718
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11589358103874586978,6884466980436131798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
43KB

MD5
db2a509594a5a1893b68ab6751b4821b

SHA1
de248758ad71bb86150de155daa2fae0ef82186b

SHA256
7205ea02f7af5c57824a95597af310a9a7f1cddb053abb3b4b82af8f09fb6f51

SHA512
37a82855bfdcd0f93c097883437c22362b8cd79530885f981c6e03fd6f2f80a8177a979a005feec10b61aa2b84b49faf0a05e548d472655eb50ff4df5b159e73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
70KB

MD5
ec080122ae1c52b26dd5a8b316ccb509

SHA1
857e7fd84764f0102ac414aa5fd264d30dec1826

SHA256
629b4db51c51d1b8927103d83a79caa04caff9fd53caad5c1c1f3410345e06a0

SHA512
5d38767daebab4da8b73a43246995e706a10aaceca4ea8d7400c7b8f1f6074d66b314cbe5f8b1d0a12fa266a0a3dcf122b0ea0083b5eeffc4c5f328225016f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
32KB

MD5
764b17e1da6963ebc217a49b77a91522

SHA1
0684a8b6fe9eaf83dc0712902ac5c9721f7e0a42

SHA256
a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44

SHA512
c056727c4a1cef069a45e030e55784c46251d3aadbedbf058b8941ff856496a7fe0eef174750d063247fe7fbad1932732c0ae06d788489f09c81a08ca287fd73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
121KB

MD5
48b805d8fa321668db4ce8dfd96db5b9

SHA1
e0ded2606559c8100ef544c1f1c704e878a29b92

SHA256
9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954

SHA512
95da761ca3f99f7808a0148cfa2416b8c03d90859bff65b396061ada5a4394fb50e2a4b82986caab07bc1fcd73980fe9b08e804b3ce897762a17d2e44935076d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
117KB

MD5
4f7c668ae0988bf759b831769bfd0335

SHA1
280a11e29d10bb78d6a5b4a1f512bf3c05836e34

SHA256
32d4c8dc451e11db315d047306feea0376fbdc3a77c0ab8f5a8ab154164734d1

SHA512
af959fe2a7d5f186bd79a6b1d02c69f058ecd52e60ebd0effa7f23b665a41500732ffa50a6e468a5253bb58644251586ae38ec53e21eab9140f1cf5fd291f6a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
202KB

MD5
6a16cbefd2e29c459297b7ccc8d366ad

SHA1
40da0213a9e5ea4cb6948f4a8e92b5e8b97e6cfe

SHA256
9462da5aa6e2a762b02a24b7305bac86349e5b5ea182d36fd6a163de550cde60

SHA512
6a9de0231f9987554a20208a89c6c802d28c57ecb6f9e95771c94156b65c61ac1e18298ce6d3f0559d3a08052845cc2014dab335e119fde731d745e4857b7d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
425f88c27f24af74dfc50f90ba7924cc

SHA1
e80c90198cbe61d7ddbdf24d2845aeb7892f1760

SHA256
7ff586959db90ee55869ef9899e57c81321ef6f0d76949d5d06bf32aca19c3b5

SHA512
97dc2473fac4bf481f3a087212a4abd63d21e6a76a6c41a5ad195747e20e1f97d96d3017296e838b4dcd7f35e51f17c6be8edfef544bab3799112c40cab95ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
77f34151e4bb08bb038c10267b9b54ec

SHA1
b0269057d1fb0b61710fd0b9192714357f071cb4

SHA256
440d56072d6ba8e07cb212d8197d568410ad0caf028d72ba4a142d4fc1b7eb1e

SHA512
a56a57f5686b2a7903db66902837ee5cd9e6198b5b5dad36f1273e03fb553d5a5613a910d966726a15cace7a3e12d616d1e526f7d5eeeda2a93f83525c61fc7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
2a3bdba64ada0ffd3ab940b0a25dddf1

SHA1
7e1f63bb15532912cc8eaa1e790c6818d648cd75

SHA256
660eca5be7b7d711d00f5cef909aa174c8f2321764311d2fded0df1b1ecee5d7

SHA512
5dc508822bc8495976f94c8ac9235e7f862a5908cb4fd2519869f96c6dd3997a0e973fc718821c31e1ef54fc9bd6e4bbfed330d8adcb49c59b48f54c4a553f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
40fdfeca7bee348f3a1118cbe8689193

SHA1
0a744820bda751020014f700239a8ae3d1b229fd

SHA256
b01618c5a1989ab650e583136ac72e88c9123afd4657087147690c87d8ae2f8f

SHA512
b7184e815ea8b1c69071f88122e07f4f70086bdaa2cc61fd222fe340c25e5226b6c0ac58de572ec15467f7aa1da99f8bc2b656902c46217ddffc442e5e7005c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af9739351aa0cb2e029f4e807c377ad7

SHA1
e28438af9725f4c299912073d9823b38f8fe310a

SHA256
8d7ffb5ce0d4c00af51f12b8f9ec4d171bd40c3fe181bce8e07a112440489227

SHA512
328af895d70d4ef04cbe043096c45c36a871e3ea707d9ee92e85c55ee047243ec976222821da0938324dad4413133380722d9723b6b95dde928737d8245ed479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81dc7bc4ce9d9012753cb9cdef78f83d

SHA1
29e9692b5defa327b838ab0baeea55ada6724779

SHA256
bf95aadcf01d2486da63d7d210e70ca98651ab18195ce42b2a6c3d33b4c6de04

SHA512
cc86db849e5714d53d492b68eaa0ad0d38548720c99651f2ba1ef3683960471aff343dd87177f353ff005418f5158aef0d22014e25e1168ed763a582caa65e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ba977e34dd5986f6be6f65de00885bcc

SHA1
1f056d7793de98a70d234fdd37d0e618f144776e

SHA256
cc5a879081a23615ab354a491ab88ab2ba4447888db4525d07e620e8b5267b5c

SHA512
b8736dc7ce366d99b102c9047f411606df7c4487f90ab2499d205945908363d0881fb5f6a825acd39881f31cfda7bf13ca20126809e9b6c5ae5a583cde12005e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9ee4b42d271d9dccff18ac7c96c5641

SHA1
1e10b2e0f36bea4462a16058a4646f20c3519208

SHA256
60b7f723c639d8660f76cc7648c2713c318b067a002e52e8c2614fa6a179f5de

SHA512
313a1c49a37b64998a560f6cf2117b2f9c16e245232cff1ea3fab9ca97e0b564a20cdb88285cb750970e315d91acb0ca2cd7213377a5f77447b8ab4e1ec9b998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6db80d4879b5b476bfb37d97818c168

SHA1
a77e9831698f6be4940b1f19747168af0b19fea3

SHA256
960f137f84453ea56106b6d8771324b6f61b80e09d4c00d7b3b25eb333382234

SHA512
b2e3b858c810872b585d5f0eff6c34623258a6d9e9484554db4cfaecb0f5694ceea122e8744bc5fb4058a63e0c64e7208b5e95b9f3c36ce7bd795aca767f8792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e5a23164fbc744173501a7805fb6e6f2

SHA1
497e6f5b86c7839f4c53fed7364f46e365c53fea

SHA256
2fc540ae8a54fd1fcf09fb1145059b9cbabc2653a06314ca3fbc138f566c7fd7

SHA512
ea45f92a2f0fdfb8ef126efd6c7c4f82f83ba0ce3b809e42389c6a9e173b74e0afe8fd0d06bc02889f5edf4ab52764553d64147feb4767cafbe92c479b584a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7a981fff9c5cb8db0f75eef99ef66d67

SHA1
7f5c92f97453322cfff9437a291ed8e2ea2b76da

SHA256
2e93a480230792caa8d48778af79125862a24c834370e7c7db724c59b5702169

SHA512
158ad03b25ae5804021dfbb5a86de265aa2c6330586774305b154c7fc8bd6960aff2f519f729e3011c9ac1712ef382f7566c56024834f57cee8441ea1bcc9f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
69b321fbe68d800530d8cb42b93f26af

SHA1
d4b1b4ce6eaca613b8833959195251dd13e53c21

SHA256
9abd9bfe692edec1154d93adefbf0e701e91abf2dbad2b109ae62713a1e22eb0

SHA512
aa798db3113b6f6bd831c4772903643e3d2def232b582f23c7a15e28aed2c59a49f0823467701469ac106c65c912f870abf31769e6f0a7d270965035c24086d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f6c021e2a7f9e29d899b5eb7099bfed

SHA1
b5822dca40a39721feedc7a7cc7a6ba05c15b44b

SHA256
cbbc106b813dbf310ee33698530e3aafabe9d5ca60897572fa154b3b2cb6eff5

SHA512
a1f1c025b5b80ea8b10fd7e7f74590a0e8ead4cfcf7b9fcc250dbb08fcb46167fabc10178369f12ed00d5ce59dcae0cb8657a516454838b21a4f963c9d9c4660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
06ebfc5c81b25a75a55df3983582c140

SHA1
38a372c5ce684961d87284a1a948435906c57e09

SHA256
64ad77ae28726d4d4d5eb236cf5f4ca34c7f6e7d6d437e8f2db959308fed8c9f

SHA512
af52f068621e0bea8a552c86aa01c10bee378bf1dd7ecb37b9e3c968018c34b06f01e7c949ae781cf59375f5baaf18e747746d8b3b74fed4e7bcc53634e9f1f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0dd.TMP

Filesize
875B

MD5
18d0ca252642d3fb169f747b0ff7eda8

SHA1
b3d0111f03962d33bbeddf5c80750d53bb1da907

SHA256
8b1d1c3fbe87ff08eb16065bac02dbf6de9cea49035e860176f59267bf87103d

SHA512
ee91e22806dfb5029c4c8c4a26d9073641c4d9dd735e7c35212c7fa4f669c70bb6c7924f94647c5ea4d2a6f68fe4f8a70e63075e718ac9eb345d935efdda0302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f35374c90c33b69a72b6d59c31897f7

SHA1
232acc88a24fe37145372a91f2ebbf1ebe985b00

SHA256
877678cc281fc090e8bbe9bacf82bac07178dbd5afd46302b43600f7a54d84d1

SHA512
f341ae2cd39bb958d8726a878db4847c559e1f496bf62deeb26286a6a2a1506c2409dcce9174981e79fb7c242a2d41f9aa0f21f12a99f19befadc52d78a6b558

Download Submit
\??\pipe\LOCAL\crashpad_4492_UZCGQFQBLFJOZTKA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit