hxxps://krunkercentral[.]com/krunker-hacks-tamper

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://krunkercentral.com/krunker-hacks-tamper

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
2692	msedge.exe
2692	msedge.exe
3632	identity_helper.exe
3632	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3136	2692	msedge.exe	84
PID 2692 wrote to memory of 3136	2692	msedge.exe	84
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3276	2692	msedge.exe	85
PID 2692 wrote to memory of 3648	2692	msedge.exe	86
PID 2692 wrote to memory of 3648	2692	msedge.exe	86
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87
PID 2692 wrote to memory of 1360	2692	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://krunkercentral.com/krunker-hacks-tamper
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b75546f8,0x7ff9b7554708,0x7ff9b7554718
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,333107803762202532,5370145268763610169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
c60d4cabae351d957f39f5bb255075e7

SHA1
90b9b261ee2b2cc44cd6a95b04da6857f45b68f9

SHA256
cbd27d503028fe7673eec3c9c15ecb585792b5af54e8b9f0fb812b7b520e576f

SHA512
c538638ed5653e77ac6dc4b2d7e031758105c30cd330f341819843c8c224bbcc955fbd3b98718e4a720925cb8a87cdf6f3771f06ddaabe93ac5a7c37b1fe718f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
3a0141693678b0e0b03d9ff4f5bdcf82

SHA1
ed6de2145ff60f660c1a77d08f924d777ab97f21

SHA256
3f357a2daaa79a1319caf7ecef401799b516bb6dfedacf949bb0f58ca56f37fa

SHA512
8e80a7f12320dcb4aa8923fdbb46a727cbf9176c3cf2b8013b5e64356c0770680b3edaf77660ccc136201ce18b9a5cba5f140d31cce1a6a7ee89958b26d7bdd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
66de43550a0b8138f8eb14f95cae1141

SHA1
13dad2370d3c0bbbed6b3b7ff79942f3004fe6ce

SHA256
3197548971a9fed16164bbadafa9337a771d1d5b9c4673161e042dadb5dcf9fe

SHA512
c0251a09da19c080075350408b35c36a7d56107802741ed7fd2ce82f2eddefabf605753bad762ce8223a414e29d8b58918c26bc6b999894e64724e073d002fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7f8b4b70d4ba18cd5741bfe5a70f5213

SHA1
33663e0fca174e893029d33402469d19255b808b

SHA256
1e83cbbf822724f8dc644f266a3adfe012640de902fb7a4c848103689e2f6d03

SHA512
a84be676f5238ef77f38a03e3bac1d28b86a9a351f036903faad107539ff0995d27458544b9a02c49ef873d42c9804f80b4ff66fab841cec23be0ff91f58c7c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb1c2d9b6fafd954ce279508bee03829

SHA1
793bca0b4447d20896c391b3271d19cb41b6022a

SHA256
24b76f63e0d5573e0526976c01139043030ccde3b62038e8c19703fc3193a23d

SHA512
7ed5d891fb0b11bb8804aeeb96c1a208541b547b933e7aa76e096107287663b4f29a999dec3031481220fea624a8723660e9de392ee4e3852aad70d8eeba75b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bf45b07d93d2fb7900fb973b5e81bc1

SHA1
0aa216b3271910e857f059f2b1c4734038e6a7de

SHA256
18620a3560ddf8ee4ce0e01f7601626b6bcd15ac917f2d963b372b20744b1303

SHA512
2ae4cdfe8b5b928c424fed7bc552bf42e4a3180d4dd65c97282c878e33f0b2f3e246a10f5d34083731618651324786b51fdf6ac29392e2885b2d079b0af9fc26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a40476b7697669e77e0490f80991857c

SHA1
9030348295c17966e854a1cd6eda68dc5eacc5df

SHA256
0e2ea822d6fb32ad0481b5850890a721cebf63752112ca040c00ae5ad99644f8

SHA512
60a72df9104897067d21706860279b51c54db9fd2377b636791086399e5430bbdf08477da8d177deff0b03671797a32d5e66ac8e76264a838314e6996967d9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f17806e948a55497e983f7797caef1e

SHA1
ab5ea685d897b9b7ac6b609600c2676e7f4ff18f

SHA256
9e4bd4213282e3df5c86fb4f08dca5d83c802f26d2ab7d4d27169166b29a4aea

SHA512
4399d2813acbf0919c25dd49ccdae53ac95e192daf80121ee12154b6da61bec7474b3fe767fb21585261da9e9e161b0992eaf44ca1cbdf4543ce2157e286ab2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ebcdfc2755e4e500093141c46e307abc

SHA1
6db2b801918333879d9e7d9fe1deeb2877f0da83

SHA256
b82810e58106570f66d25836b39f75b3ff8904895f610c696ea68a0e7b1485fe

SHA512
eb803d3be0a4dc4e1cec95a8ce276f40cbbff09ddab6e2e825527a49f8d5e2694d6b9cf937296de8fbb4b71d6a3839d5c1a65809f5d978e5e985700e69df1e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a69.TMP

Filesize
1KB

MD5
b0d3123d2fbf38b5996b0b3ce6e56bf4

SHA1
ca52a79276d2f9952c1c4a14dcffce962d054515

SHA256
dce6657d95ad341791ad10777bfeeef7a219b589a03a707bdb58ae993889ff9b

SHA512
bb610e3abeffecd4280ea6fb1eb7b7892ee4a553c60232f3197fd21adc4ed6e977e70fe381f4eb089ef442a08d75c2de466b9f577705584cf42425cb8f14ac2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0e699750ae2b74130c5a7ab3b993cab

SHA1
81a6b45e0cde069ecdffb5b0595de0846a4c804d

SHA256
840b1447ba0fc6a4d276de75b94af624c485d09641506b1da5a003b3fc7c3559

SHA512
0e9b682acdda376738de675bd0b1c5f6c45d6e21339953a21cc06133fece3d5572d9ee9f99ae61f33df0be939828ffba90ec5c8415fa85569b7c547c5a867674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
13eaf0ee6fd4e1571433b535daa725d3

SHA1
1caac5874db318e84d1cdb63e6ca8e0cdd03f0de

SHA256
3ee18e8832005973d2202789fe0b5e466cb138977f5695911992627b0dda4b45

SHA512
0980839752072b8919c1406e11e21391fe5d7483620e02c41da66734e68fe79ec0e8e57fc1ddc9b43f9a1e14c1c2a8469c6adbbf5c70cd545b6c3d0a9db75c49

Download Submit