hxxps://shorturl[.]email/e/ExQUjixBxgF4

Analysis

max time kernel
62s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://shorturl.email/e/ExQUjixBxgF4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
3140	msedge.exe
3140	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 2148	3140	msedge.exe	84
PID 3140 wrote to memory of 2148	3140	msedge.exe	84
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2176	3140	msedge.exe	85
PID 3140 wrote to memory of 2268	3140	msedge.exe	86
PID 3140 wrote to memory of 2268	3140	msedge.exe	86
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87
PID 3140 wrote to memory of 2220	3140	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shorturl.email/e/ExQUjixBxgF4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbb6d46f8,0x7ffbbb6d4708,0x7ffbbb6d4718
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,18443739191811332806,2904563494680383179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
98KB

MD5
f996e49da547473edffff57b1b76231f

SHA1
1e0cd895f6c2a60a4cfd25cec7941000203fb91c

SHA256
429c245c93f6801d9d14dc1c9128aa0b7dfc69ac1b054b6f3f46d25d77a59bb4

SHA512
e94613f37fc596c259074736181465acef2e6c7992e39eaa8f15ffbfae240c3eaba9f0f0f500e6b415c13ccba30343eb8dd148a7d47558ebca3c007dad12240d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
59KB

MD5
7fd069146ea79b16633bc8b45f90482a

SHA1
98dfafac54f6f5db51e3baea698208833ed1b642

SHA256
a746ba588555b584fe98e42ac1a2dfbb92c2831b54c263f51fe91d124b9214d7

SHA512
c31822f497ebb35a5da455e77965f16a83e2007215ae88e64bc21019d8d45fff4671ab4300d9cf518bd2b652d071cc582fdfb99b4807c75e2022755e6c60a06c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
51KB

MD5
a1852b5323e1e4948f64c40799dc605b

SHA1
45799a41d7d105ecf1f20ddec0b858f0023701b0

SHA256
3dd244b14869619ad7208852d0cc32ca2ba0440bca1ca593280710c91e40a2c5

SHA512
83ff1136339dc73e38444fc3f9e778b007245979c43d5e0bba0c4261489cd27004239b760fdd6ea462818b5a348c8f323b854df5a8116e1bcab23abab185d1b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
31KB

MD5
5be09c7c686dbba1984fc1a2bacb772c

SHA1
b0626f753ce1f18bd01b5c29d86af92a7152e07f

SHA256
c85491a931fe791cd1b23d54b42bd7abec503842ed5cb76420ab365c4ff45b4a

SHA512
2fb59449fa9a0334e85c0342352037a60378e484ad0e0cc417b9559fa8ef7ac81c972a50dff01d177db0875bf244b3ba90bda0565e269be8e745aa7470e223b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
51KB

MD5
588ee33c26fe83cb97ca65e3c66b2e87

SHA1
842429b803132c3e7827af42fe4dc7a66e736b37

SHA256
bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760

SHA512
6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
d85c53477a572792726ca2e8a29ba604

SHA1
59039a8f06116c7f7d4318f77f01873d7c4fb886

SHA256
cdb268f24a62663703a0bdbb993a6972f0392dde0e8656d0de9db0899ca1e782

SHA512
c35d56c37de69c7324369274c4d59632ef47ed40653bdb1108112248fad7459c27a2b2230a7b655786401cca72a9039177abfcadd3ec9046909d04724555a388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a14c15fe7f100372161910844ae66090

SHA1
15346831599956dd4cb1f6b44c60dee60916ac29

SHA256
23a35cf506dd5490280d88aa4da18f39a54a5dd8a537c247c63cb3067eb8b5f1

SHA512
e2c13e2b705593d52339ac35b2c91df3a15840b068b2304c92cc24cbba04f1de1de46bfc74b4053665c54ac7a3a3da50c4df88a0c4f51e8087b6a7dfe4c8bf7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
17c6bc24b845466fb196d06363457528

SHA1
a8dfd0fd60fe968a5acdc426428d2fbebd37d75f

SHA256
6cdf2e26525f36d6324fa1835493e9eaf733332b94728605024be8a149330d83

SHA512
02d610573722ef97b4c0d9874aa23840444c30da992d82555513bfd818da41cdcc085070ed96b9ba5d7aefb928bcfa17a6f98e8bc249f5ef897296df8d3e56f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
07a2d2338614f7bc02430d7e7e159512

SHA1
90637bc7e68be55ffaad0f72e6e6617b98bf0834

SHA256
ba0ebeccc313f9e842cefe3ddc062a31ada378194dc8635d26413bdfd22b56a3

SHA512
7b2bf815e32ee1da86a2d8e066a32c94c81aba7d438f4a840c561502bef2600efb6eb76395e8222301296a2a283880a41597e3692ca2f034574c698d6de567ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eea72240bc918b417450c247d479ee72

SHA1
464f156942115a0dcb44a40dbd38b287701473ee

SHA256
0225c537667d7d6e34038d65bf84c2c315594cae876fef345f1467ca1e5f48ec

SHA512
7707f4a1aba9aad64fe3d29d9cf089a96ffe6d4056c55e986a3211374a0aec1e8ac5a0dd9d710cfa9d501652850c2b0e8a90e0d74043e68d89d1756fcba8f478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cc3b99734239d6f594731fa4aa85b67c

SHA1
eb1fa3b007750ac13244d17ac1a5bfbf261acd01

SHA256
30122f5905d40250b3652d5313b53c2ad445b4e6b3d2fd848be0df28ceb49ae2

SHA512
ed94cb488475dd4690d3cdb805804a69128d059d058473f79cb1b682af34b7a52bc1ce187fced4b0fbcaf007f57000148e04d74c55363528d7a214412b2df355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f603341dc7515a362b1bf58d15eef745

SHA1
eab327850ef2f3bc92197f6e908883654c7da54b

SHA256
aeb8a4b89eda70ce5c3a05be33c289493355d9720d9fb040d9bd13ee6afe9e3d

SHA512
db575a6c2a41b09a452b367c0f6c025439467b94836d98b2a66bcccb5736ebcf120d133187fb01d10561a392ac5a2dd23e29e5560f528425efccf28e5bde0dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6512271094171b1c18acaacb09b22cd0

SHA1
759235438b309cb8940e0ca031c26b3082d4b120

SHA256
d31d78934eb72827beaaaf8b7df6ad26a68321faa0135dd10003d598df360738

SHA512
4a2b7d4960a6556b8d4abfcb1d8e945e44688b9dd9ba5025ec58eed05da45ef4ed16b61ee79fa57ebf24454b95f07d2adaccac6548c4d832a2cfae03e59fdca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5806d1.TMP

Filesize
1KB

MD5
88f399a81cad1a549bdc442b5081abb1

SHA1
fff6f6da741f5fcee07b79b47e08cb8248f9d4da

SHA256
c372550c023c8170f18b22b15453969a0d0f59fc8b00abb59a44bbbfcb0bc7ae

SHA512
36844130b9ca27f2113db7395204f2f237a0fc2a11024d700f2d433eb70932ecd3a7979d6d35f92129771b0d3adc574a7a6b2af46af25959f04193f84191bc09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9730405afed98772c370ba8616413ac8

SHA1
a9381cd059af356b05efcbf6de924bbc9e1ac0cd

SHA256
ca95435efe5089dc2d1a4d60e87814c1318ba33a4cd2f69c3389a10069547368

SHA512
1ba6f418345bd21fcca1cb2f7520dfa880bda4f178a55a0fe5319af527e611ef89c3c48f5f06ea76bce925d1ced349c5d93f96d39fe5b90ef95f5b03ceeb0597

Download Submit