hxxps://t[.]co/k8CyNvKrTm

Analysis

max time kernel
68s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/k8CyNvKrTm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
400	msedge.exe
400	msedge.exe
3916	identity_helper.exe
3916	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3996	400	msedge.exe	83
PID 400 wrote to memory of 3996	400	msedge.exe	83
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 3988	400	msedge.exe	84
PID 400 wrote to memory of 4256	400	msedge.exe	85
PID 400 wrote to memory of 4256	400	msedge.exe	85
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86
PID 400 wrote to memory of 2768	400	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/k8CyNvKrTm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6c0f46f8,0x7fff6c0f4708,0x7fff6c0f4718
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3121163917977536939,16016460962138866311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
63KB

MD5
a2b03561cabc0d346e9a6be3f5b11b5e

SHA1
ba0aea2acc1c20700c4c09c5b2b8d0bfbd33ce6b

SHA256
09588f4db755d8d88d9e521f5189d97c2ac781ee7ad782bb0c644eb9f69feef1

SHA512
3602c58bf569bbf22d2a559f0a62c4ac8d6c9868dd956cf0d75d694d104eaf2f82d22c9427636a46ec82cc24e758ad1eaad75fab771ce843308c1b2fe57c6ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
20KB

MD5
539809cbc6f6c4e0fd229994e35f95ed

SHA1
da4011130179ec3274843aa17f6742b028123f3f

SHA256
ce15083cc0d3b10bb9940534312e6500c63a62fdc847ca65bad851d58047ba67

SHA512
d907234418ce3796b7525d883bf36fe1cbc901b21b13cae4cae4c9bb70f612018567d100e3cc61eda3814e49ad336a16279c889e29d96b94a11d4733310669a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1a1648977dc49e97a27c515edb37df8b

SHA1
7ca540d7c3292b87ca12cacfc64d40853c9e26a1

SHA256
12cef987f8d8088b849e30fd792ebd090ed27cb7adb4f19ca36eb4db4704c5f8

SHA512
3ca123f32508271ea0a7ff291156b1b81d52c38357d9ed06153c4a2f9ce9089dbb5d4e1b8dd06546cfc168e5e29fb4bd4b7ac4d981b2f235081e8037134fcd65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f030d7522d6f8b86da503a32b9b3632

SHA1
9a1b4d6aced191e758f57480db845c25aa797b5b

SHA256
7514773407ba788956bfa7d7a05518a29cae7d759cc24dfac49016d959d874b2

SHA512
46d48ac68cc604ed9b06081335087ba95739794214788d7d791ad53031334a6435430273b03601b3303ba8b8c34a7b5cf2b586511007bfbc04a800254fd5d135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ebcffa6cd489d2079847faf8f772bb17

SHA1
7ae58a5aee8fa43e7f0c6b32ca48f398df974796

SHA256
3ba6fbbccb6b4b9697b133d98cfd49b06e243fffe087283e3c4f65d799895e06

SHA512
d0c191b895391544789c78c5bc0c124595bd27c7bb90dcc095205ff97f66070f2d6fee5281f4b4969c6ed588606560698be45dc307fabffd5cac323698ff4222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68ed32f8395527ae5ba10f736aadcf70

SHA1
71aae32e5b03ba117e085c08b7da80288909a6b7

SHA256
d7c621507d97bf54424cc14a7660f79e1a4de2d0c8d2fd53ababc9f8d560ecf4

SHA512
21daf2ed653643022a57623c433996940a4cc55c70614a41bffae49bcdf204679ec5ef514bf81039c2d5cd8078d9dfa3e24696028e9078602bd122107b6e0177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3af0620af78b402794e01dd9cc4552f2

SHA1
15dbf8626530a16914c367ccb1ab2ea0d7153100

SHA256
a1f01ee1070b5a772becd05a28ab7fd07f0c984fe924f85e7420a1053e49f667

SHA512
b63c2c6a42687edb421a0c8c7b1f9cbdf0ffd1a2229b7ff607d7300dc5527abac3b4e1b98fcde1bf22b4c08b08d8f5fc4ff438b30c8da35cbb8f252c6a496b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9bdaa8ba9f7985b0e0ae4d67ea8ef583

SHA1
4576ebac651dca3227fc70701e83bc95b64bc43f

SHA256
50d3364c179454005a195244e6cf6093228fc492596738d209084679930c7724

SHA512
512a01a7a1c46378772e9eee06d66c58ee87ec317f4dec645f8e1c67f49a40020b49f0b004e8c779bb00897065c63269ad638ba0bfd3b5f155b45b36adaf7405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6db03c6b98b8db785a6f1a30d617687b

SHA1
2c49140669cca555ec2f3b11775a702f117764fd

SHA256
5a2ddeb24b35b2c3d7340cb97ad7a2f22e90a6453021b975f0546db5553630b5

SHA512
d301c67df9f241de3ddd2a6cdd1c29f78005a8ef2407798e397a4e5eae4b451b135a210b03fafd38ab820fd777c938e8992dba5c7d1b6f6ebd258f38155102f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f04b.TMP

Filesize
872B

MD5
10b68b95739eb604e63d02cf10df0a90

SHA1
59992cdbb0b213df7a8a0ee4d5201c6c4f026950

SHA256
be0503b84d7472249d9f079e55a843cf66c9204f8531e75c1023baf6c252fc71

SHA512
b46375227b4bcfff1306528719848dae29367f649ea8ae1eabb4033b2f1020487161e8f9f21947e052c404ad2176f374265d3a4fda9ef813f9bdac98fc0578be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8787c3c-3c70-46e0-ab72-7071a3302dec.tmp

Filesize
1KB

MD5
fd344156370966a0bd3ec906ca5826dd

SHA1
0ac239e991ca6179745c4e45d54c24e2878a9fe8

SHA256
e742a1793a94b1d2c9ac39399008a91d0512b67495f509e49ed6658e647dcdcb

SHA512
043130bfd59607b74e7b8665f871ec8ffdf515c998f51f39170a615fff2fc5a4cc5efc13287b416fc98576961b1957b6a4224f60121bd403bbef51f3c4a09168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd3ba689deaef6b866a641c27a4f8599

SHA1
b1a297d9cb126974827d9744c60242ae14f79bab

SHA256
688a3b5fff29636ab226de9cf94691aec39a40b3e22719629d1ed65714bb2fb2

SHA512
7790a55ff671091e7a3400a35ccbf392f9e63f39a335ba983eef50e543e54fc47cb73cfbe20499e35f301bb7394c46d032ede8142df2853d1151992dc3f722a5

Download Submit