hxxps://tulpical[.]xyz/

Analysis

max time kernel
1819s
max time network
1804s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://tulpical.xyz/

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
69	discord.com
70	discord.com
71	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{03BC30B8-D76F-4974-9003-7B2D4E88C63C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4828	msedge.exe
4828	msedge.exe
4036	identity_helper.exe
4036	identity_helper.exe
4064	msedge.exe
4064	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4116	4828	msedge.exe	83
PID 4828 wrote to memory of 4116	4828	msedge.exe	83
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 612	4828	msedge.exe	84
PID 4828 wrote to memory of 4272	4828	msedge.exe	85
PID 4828 wrote to memory of 4272	4828	msedge.exe	85
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86
PID 4828 wrote to memory of 3416	4828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tulpical.xyz/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce08f46f8,0x7ffce08f4708,0x7ffce08f4718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7816545425354661700,10950984235155459574,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
bb5c438e5f373abb222376f7d57b0e4c

SHA1
ad910724d0660ee921d599e97697ff432c26c016

SHA256
ba103196349c884d1cfdcec361f0e7d2576005bfdcad76de697afd629376e753

SHA512
72efbcb9f59b3cba9efd833f0a8e83a0e4c018f2232968de82a5ec0bcdbd42b3f7459acddb7f0a0ca7dd20676f3dc99f0f84563cb4b1a69f38561473e064fc99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
88b3fa5bf1435c86c51b959b1917a304

SHA1
ab6a8bb40e2a97e76e203b49c2a0fc4f457c39f8

SHA256
4fb0fbcf480438124ca5885c15a7c0b323c93def35929f7da05aff92c73e0f58

SHA512
792efd348e938376c3874520ed405c25bc01c3b6a7cd3413021acdea5c03d2ce038eda5c22e3362d038a94e6e9b0f5af8cd790cab2e42687e9c6ad73d265bbd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4dc98e962e891e0e25b38998251b176b

SHA1
364658494b2ae2cacd5508f02a421f72680f2627

SHA256
082cd27a375449dd93a4383a2b7dd0a6b0ec3b6d28adce5b07b4a0a8c2722776

SHA512
68dab62e7bc89e89a8d0f96d4052c4f8490c3a6377895c89ca2bf57365541091d2ee0df9a291614c22803d29e93810cf6b6945ea409eaa587ba920b4c0b7453d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ff4e8f7e564a78e4fc709440318e6a9

SHA1
82470974ee327d4dda7cccbe093d73403461d336

SHA256
b8cec3b143c447df98a53aea842a407653b30d2d167ed90b984c215e767b8186

SHA512
fb96101eb2b8496e9bbc4fd19126aaf4970edf22963dfe1c11a563c4a575582495b2c82b59ed6ab61d902114e8d974acceaef8edebfd4a00f4dd3216f50cbc15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
226b6e6c0bfb38538fcfb98ba17487f1

SHA1
b3300bbf7c5f3aa9a7a7cde9b18cb8a1601f62d1

SHA256
d60963e8e1069a4ecafc4e5e31fe32ab1c227248919fd8e63535bc5bbeed89b1

SHA512
4c347fb02fd6c5078ed9c110dd3a7cc499ac4823305c04ab88f019d60d4c348c4198bf08595b607dff3056c2d0fc99cb035ecf6349b85a6f3f5c599a1a401946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0eb5fe63d97d2c16c9570cd82c7308ba

SHA1
fa9682fb74d0a87e2ff2238a8ba35fa3466b9a6c

SHA256
f053526ae78aab5370db23f47e97bdad9224f7a63941674c0eed9462e94aefee

SHA512
4af0f0dbca6bdd4a8c5ad50172ef9988ceb94e0a7bb324a338ae56458cde2ae46d31ae3cd6f86c7052a08df6d337e9049edb84845f40ec7b344e60d6dee7747c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7b4979a64e17b588cb64fb38a3186d4c

SHA1
214888b30dc8324ec16437a70071551a462ad92d

SHA256
bba4f04233d5523334f15ef442547b4591f51ca0e001362d35e0515bd9f50ca6

SHA512
5c954ad80c0b2e18856a6a48a670c9c614aa57512a3e5357ed1b9eaec71563970306450db2038a65c5fc282d688098665fd157a0623c1239fc82b4c3eb6c96b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cf3afb3c0e5a0ba41d4168ebeaf172ee

SHA1
72f7be44342c154f1574353131598290c6620de8

SHA256
10f93a39939ac693e2543ab5342aff019a3f31983facad08a178b1a31f7103c5

SHA512
30436f7615792a973bd83302a4ec29458c19b8d57ac456615efe79044a719c143f3541e490fb866ece602d6b5cc57c5cbcf81f91084edf9c9ca4cafdbd7846b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
ade5fe75e5e7ced98b720490b2f02f07

SHA1
53ddb7ef30ff42b4b8a888b8cb80908ef8d75188

SHA256
1b8a8fd9a70cb3ed04b4150e852cbf3756e2c535d567f27ae58e73e8f76a7f51

SHA512
b72663be3a21be5c2b1b970bcb4570aa4dd18edbb4b643a90d731762c1a5f1efa9bfbc0a217877c1a2988ec15f7ecb595a20cf60f46fad02f93919c26f4145c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
e0a895d1f8a77896e38d76e4841e853f

SHA1
20011bb9f5465b84a01544751b94faf5c620a799

SHA256
a69a1e64f40dc9181a436f3177cb7b039fc971efebef756ab74c367f89c73ff2

SHA512
9afd95c76540fb2e5cf3e1f4acf682e5b9fb5ac4d428a40f8bba7dc18290ec7e678f68c35d33f92a0a9a9745d1c74151a0a6dffb50e51fc5c3a877b248a75982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e0ea.TMP

Filesize
707B

MD5
2f8e20ddb1e30a0ee9bb90aa0e14faf3

SHA1
d563feb9b350e039ab050d7550db5d5d9903b946

SHA256
ea20e17127d627b37d539eeb1f278b71d131962cba881a54e459bf02b10210cd

SHA512
69cc0dd05cca2435864c182b3ed6f5223616735a7b64d8afa99c2ca4fbd9010cf00e81931d5b573f526f0d71ae103a79cc672ed66a146588e2a914ff46383706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c944ea5f15c803ceceeb45c2a85b9cf3

SHA1
5b19ee7ae74af044ed896bc69305dfed33779af2

SHA256
a9d854547185a97bc41c286e5d96e27b7463ee0457a6c0ad8fa44d7ff500c616

SHA512
b54d35b64a2a88867b8fddad6264a436ce8e18afcbafe9ebdec1047399b91562737b78b38a6ad4c1cbf88bd15c5761963710a13132ff969264a2e063668663af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c794f36c0ecf84c6424858a11ddb244

SHA1
4b373fd45400393f2e80251cbdbf0e428693efe2

SHA256
ea3dff3bc72b70f6458940c5bb4aea41eb95b04769de89eebdb290b800c76ce2

SHA512
c2bacf24cf5e0cfb0f34ea46397de8c85525b5dd48f4d95de08ce1a5f97d67af3f1d62de813770fb609c91d3acf28c8b54bdae1460511540390dfc5f2fe7592b

Download Submit