hxxps://is[.]gd/uh7rTc

Analysis

max time kernel
45s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://is.gd/uh7rTc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{2DB638AE-B754-4919-9D8A-0A183E8D991D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
4796	msedge.exe
4796	msedge.exe
3860	identity_helper.exe
3860	identity_helper.exe
6108	msedge.exe
6108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4740	4796	msedge.exe	84
PID 4796 wrote to memory of 4740	4796	msedge.exe	84
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3728	4796	msedge.exe	86
PID 4796 wrote to memory of 3380	4796	msedge.exe	87
PID 4796 wrote to memory of 3380	4796	msedge.exe	87
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88
PID 4796 wrote to memory of 2544	4796	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://is.gd/uh7rTc
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe13ad46f8,0x7ffe13ad4708,0x7ffe13ad4718
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3932 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15553549089251405480,11492758860376754019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3392cad20b1f5b6e5c34518734486e74

SHA1
7930c69d45f461eca1ee2c946ac549556bac8ab9

SHA256
003fcaf16b16fb626ef270a311dffe7dc499db46ab7e43fecb612110c72686dc

SHA512
52c1b47e8b951413664439edda157cf43664460bf95e527de842efb29f71148bfd7a71bb1cbfbec772ef401cd3c94e556bd8ba336b5e26174ee4cbd87564e446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d8421c735b7dd37fe6145a06b58b343

SHA1
cb2321152e0a9d092954510259c3c61c172c557b

SHA256
b3d56be3e0f9469152a52bad17b0569236f16a7195f6cc23bfbaeeac3a05383c

SHA512
3ff963702470c29cd81227ea054f3d2b144aeafe902ce1cbdbb407ad79dacb2263967d032c4b3bbe15eae42be0127651f660682f750bb44f0485cbb97fe47265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cae870f0061c55ed0d5c86c60b03e9b

SHA1
858087cf73f8c8c39784b4cb535c0ee146cb2410

SHA256
da99d2dd87bce5d2ed4173bb3d0193358d724dcaba1de9e2b5607386c7e90fb3

SHA512
34e36dffafe04f39e3becfa7155c368dcde16e32e24966b754b5155f065307eb45b81594b31ef82d088da51638c3633d8fdf9f7f506a83c54e67003a426f4c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fc75e0fab142228e2cae66719b027452

SHA1
90b14535846a2c89bfd788a08292bdb4c930969b

SHA256
f28cd2b51ed9829e69de9699acb57b78993c30de69b5fa2155a5a1c654d2c747

SHA512
014528b2b5a9ba1dcd8d5f22ca7aebb44d05738089f288891c7494ffda247854099f6fe714a76b4562cd84851fc5bf841b4d02460b2cd680b770743e5dcb4bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b775baaaf96339db4d88ef4f363f2d80

SHA1
79a71d052f4536d3bffc1dbe6ec266145f8a4376

SHA256
3d5b2bff45d09602872aa5a7be7c1074f8b8ce75a323d9fc9562fa6f17fc500d

SHA512
4c35436280c1777eeaa7e17f17195ad61408569a963bee001a46e7b90728b5c6fa51ba38799d18a476511e07bc5b840295f495f5e065ed2082ce171ce92196b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
d5551859893af978717342b0bf1834ae

SHA1
7f2dde06d8c91fbbf5c820ed84395d2770f6378a

SHA256
928b5df91692a67518884ec8677382d077f33466507a415914c05bf36508f616

SHA512
535a08bd042f16e8e576628176b5cdf8783f493c6c76b2ccc1664ffcf60921dd8f2039447c2e6a40e146286125adc6a1d09c605d4b8b9cee0105883a78a7ed9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f13b2380d089a65e35cd13d7ae9f974

SHA1
ac5e34908263485f198880b69d342f1287f94636

SHA256
2a13faeca82d87d2b137944a922fe408f0d848b25311b195f9871b680e4a615c

SHA512
34d56c2c4abd3725685ba5919020c59df93c6736edeed933f7fe93a27d93e98aa838f5dee99239de3faac50545b1004f6bf8ae33842ba9d6c6dff7dfbcc80709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dddd.TMP

Filesize
706B

MD5
0104e70aebd2d775d16cb7b58f250be4

SHA1
20f7c97f8665c064f7e0400deb2dfb7c4faf708d

SHA256
53f0926474aff0795943aad0c39f50757c6886ea75650ab6da9ac10894f49058

SHA512
2105965de86ca757146cf08e0bbedab40b53cc056d79d6d0153371f2c7cea372a1d0e4abe20d1b9ae27c0a12417170f826a00b675475f508b8d32da7f0c69fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b9db6df43ae8946688ce85f900060a86

SHA1
d0f1d63009d0cfe1d09cb183f59fa420a7702faf

SHA256
c5e744e6c5d614369212365f9bcd55fb3d667050df2efca4ecc56d866476ba95

SHA512
11a2c9b0eb77ce50318102be31d55e249fe66beb4683ccd39ca79aeb197d494314304f436333fe71343f5700df9e23360f13b22ce6cdbb3a85a005b156a32f64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit