hxxps://vk[.]cc/cvA71l

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://vk.cc/cvA71l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{2FC9B1D7-2F10-404B-8D79-6129581DE908}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
2708	msedge.exe
2708	msedge.exe
3748	msedge.exe
3748	msedge.exe
2236	identity_helper.exe
2236	identity_helper.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1064	2708	msedge.exe	84
PID 2708 wrote to memory of 1064	2708	msedge.exe	84
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 3936	2708	msedge.exe	86
PID 2708 wrote to memory of 1820	2708	msedge.exe	87
PID 2708 wrote to memory of 1820	2708	msedge.exe	87
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88
PID 2708 wrote to memory of 1864	2708	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vk.cc/cvA71l
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1a4646f8,0x7ffc1a464708,0x7ffc1a464718
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14907914661009390162,13280948827349159336,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
968992831efd6175f36b7d39d5f10715

SHA1
fb3fe077a05c36b29e0e00fe627ba391fbf2c79a

SHA256
b6d3744c0b720701135bafbba2c72c85a3a02658e665739879ee5543a904b244

SHA512
671249b4f9cde78109ce507172b380b4ab51045a8d711dcc8762168cf3fdb21be270aaa89c15895ca2c20deb185f04fd6dd2b90a933f5b2fa8e0113feb02e0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_boosty.to_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_boosty.to_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2d08068b3402131c1cdaf72b4685d0f1

SHA1
34e066f06fad0c27be75a3882421a3b97b1178e1

SHA256
0559325ae2a3f0e99f22d4b96f66fe69e9f46f964ec46ed42b3853d80d4717c8

SHA512
d40954a5f1346ec60f78dce5af3ab9fac08a7a018597fc869e969b229b41d90ef3adfe328ca305b8188cacaed6d229e9aa1055bd054d5b8e28fe61cff2c19665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5720ad28bbe116984cd08ad15997676

SHA1
723e1a1a54cc4cc52955eeb943072ec7535e7126

SHA256
701c5f4d85a74c501c9fb230f2960b1f530f9da4049fb561efccf07edd1e6225

SHA512
46eb67219080d691bec47a3a4315949625c1032a80c2634c29eb4ae079e3c8e01be81da6a2244f6a2c33cc9d46ed03494d72e9f30e66283e3ebb9f14066ba2ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c48695f2c9236584bff6d899031ffe47

SHA1
c8461c17c3ee7b96fbe1f7ca178bfe8501a13a84

SHA256
0c6faadb0bb5f3b08443a4f8431052283cd2cc9d8183a92f8ee38edb658aab4d

SHA512
f5d46c3fe3c071b2754c13dcc97bfeb73762e3c1d032f743c0cd3df160346ddc6ffea8b3184721507430d09c521431b16a3ead5fc76adc0fd693ab835ce34bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
195ba13e6161f0ba6003c583d25ee620

SHA1
15bb33ecadc6f587a2ce128700e7c024f42016a1

SHA256
75dcd94b78b1b5d4550d20fde166b41d15197e05a1f064591be092d9a26235cb

SHA512
457924262226fd5dc832e7af949cc32d4f4f0b68162e1d10f33ed593a29c8eab141121fb141e1f6705cbf82bbd8342bddfd17b958bf500303a0b6340c69ac511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a8de0f3adc461986f1d53be39a5ca75f

SHA1
bb6f968a3a3dd4cec1ae0c6e9509587e5f646b9c

SHA256
2513d0fe39225ae398f2135e2536f660060fe763bf984bf8036e5a574e1c712e

SHA512
614a0c65dc631b5a3af5b2b53e11bb271a8c523018d07140d8a094a109c0f0fce55fd8f577cc308917928cf0742db385ed2c80c4bcb7a3dd98104709a716848e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
31a9096e03afadfffed25537e33896ae

SHA1
1ef7dcf09a50c8b55158c076176154469b3b76ed

SHA256
ae8603e7dcb37ab5fa66aeba9dc70144b6b8df86e294dbd17d72a2ff894f8bed

SHA512
458a334da7a24e4bcbe50ad6eedce589c24ce150297de34e9b71fc3565b1b7f4cbff5124ddb6c3fb40747c1634c23bb49c2a81ef2f4d3389bce5cc736d268323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3bc645a9c742d5c372a364ed27f5674c

SHA1
403ceea44c5dc1b1b599163cec370dec9d328bbc

SHA256
73ea7147cbdb8278e0a11d9f50e0460b0978991b6070c86fe2520a7c63a2eb67

SHA512
0dbe81d0d820f2d860046ba38e4865a76e8b6f16c0b3f3b595708be66f5d239071f65b7866a8e83134a825cbd0e8a8e08173c37157583aa2f08229f0a4422abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d78.TMP

Filesize
1KB

MD5
468acc16be5466aa2e6311429cc9827d

SHA1
dc879f810e2b831075b24f38639a942983e2532a

SHA256
618db3abdc243c067378ce0f85f528b6f6353d41bd85bee0b221f95d80bf6087

SHA512
3553157360a547a5048d727c3d86940a5769300d8b6032007b774dc6d1b63c7fd3b44b69a1d1863645a4253f6bb2a9afa59854e9e2a11613c327fa7204295ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4fc575c3c37731a79d5de46ed3c399d2

SHA1
802322a89307e367b8697763b282ed5038d5a5a6

SHA256
4f88b69d162323101be542ce3261adb208af25bcc45c55210d57eeebe263c3c0

SHA512
fd08783ef482dd4997804e7e1c9de564fad5227aca28faebe05453b33f373c53450163331225440b0542cde05ec788e1ec9b8e6eb9d9a393628e0ca4d54726d0

Download Submit