hxxps://u[.]to/m9X0IA

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/m9X0IA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1672	msedge.exe
1672	msedge.exe
3652	msedge.exe
3652	msedge.exe
3516	identity_helper.exe
3516	identity_helper.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3652 msedge.exe
3652 msedge.exe
3652 msedge.exe
3652 msedge.exe
3652 msedge.exe
3652 msedge.exe
3652 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3652 wrote to memory of 3688	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 3688	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4188	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 1672	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 1672	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe
PID 3652 wrote to memory of 4056	3652	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u.to/m9X0IA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c2846f8,0x7ff84c284708,0x7ff84c284718
2⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
2⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
2⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
2⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
2⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
2⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2216 /prefetch:8
2⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=qrcode_generator.mojom.QRCodeGeneratorService --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
2⤵
PID:528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17202164179581573761,18157368072932788308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5208 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
1c29032d3685424e3c275706868280c9

SHA1
4121941a5a3a9e4a4b318dc089da62cacea512ef

SHA256
96d1d23f184a4625053a0fdbc7af94bf6f31e2a85d0adf9e2c5ec7b3ae01c6d9

SHA512
e8bb8df039dcca95e7947f218a82d19e04096124daa3afc70e2a98f55588bf42d8bdc1d76be4c9cea6290012df6312b66c3c18b93ffe0991684b406a9fbedc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c574f5549771e8ae44f5f1101e7d173d

SHA1
690fa699a2ddbf22ffb417a1dbcbfd42ad4a04f3

SHA256
3478ae7ad854079fe7a0701bc9cab6f118d77194f101b09430034676fbfef961

SHA512
9c46515e839ced5b0251cf46e3ac866ee3b490c5f42fae90900b5afa6d4bb3ba5119e3d627a46dbb0dd44f5322e452c104da7d278dfc2c7680ba6a4310c5ff86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ff68fd76cbe94dee375b7e288632a0ef

SHA1
305df9b38fa6e0cdc0020c60799ca51b184ad992

SHA256
dab4fe00968bb17e16efeb4e026c120b2b6344003cef395e983dae8864becd24

SHA512
a9076be763cacd34a53bea65036d4f98f7f00397b8774ed8c64226e7c58be32bf15a37ed13fd35dc0c6f09aaa3befc5bfce302a440c9695c9086d041126ce2fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
992B

MD5
36e0bde49205422c4f03590493109082

SHA1
93fab5763083ab01259ca0868f46c0af617cc430

SHA256
87b12500b4c90f893efce645ce9a661f35267f9e6c01ae96045f6d413687da3e

SHA512
86b43fc1ae4bf4e1b0e5b165217f3ac62149189f684a4ae0b7bf7286ffe9daee812bf9a80d160b62bb0d6e726063995e64d5f4a3b4916e9804aa29d1ecbf69a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
298c173024e5e688333e46c78f35c044

SHA1
4b79144f43f51940df290d60b2106c69e8f019a3

SHA256
e79947821576704204e707e3dafbcbdcf05dc3b613f8a755e8c7716c36c9a47a

SHA512
e23cbb56fc11eae700e0d87dfdcdf0aef7e6e4511ed0495a199cd628310d37af270acd544aa132623a23358d73e8a2d004d2a9ede04e01b20f3373a2b5189244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27bb46ae99f45555cc67615dfec42a2b

SHA1
bee346db97509dc4088e85e8ef79128758676012

SHA256
6f4b3447f12a2e0a0c7b73459ff4328fd88d953f9b79f26d7f63569657885e69

SHA512
cc7db3e20a82b943a5730aae59f2e63e935702beede15be36235ac1543840053afea833227f46b0836661bc0ad0931bb4f2aab90e70588c78dcff009b1172b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01d387934975b7da48df577c284979d9

SHA1
26c9d80dff5803407441c25f7e370b9bc43f7687

SHA256
d66cbeda72b0239c0613797a0d4cf0c87f0b148bbbe54ef4d58d82d9ad2545d7

SHA512
024c2e85d5d8bb216ef4c00f4511a106be8d794e27e93fae38e2f3e73504389ee1ca94a795310c3a6a25e481e7eba1c27bb39e542669a9b649b1ba8ac86c1b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62506f3bb7d2fc1ad69e893eb6cf6174

SHA1
ed40aa4eb069955e9b84e978fd103c34c67434dc

SHA256
fce183673cc149188da1e8c54bf812288212efda79fdd8871f6bde01791027dd

SHA512
724883620aeffce950480ba7f3a0bfb7df78a2a5ec1081dc43128030d7330b596e040ea1649e2620c0d37c74e3feb7383b7109085e2e56fa7ab475ef5d9519e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
b6454ed5e2781e319fe56a735eae3502

SHA1
1983cf5a41239f9ab19a6609bf579a6dd507da34

SHA256
e4ee3b1852fb334863edc942f92a835211af947e78b4515ab46f6ecb36d55685

SHA512
6a25a06f5ffbf28f6e42c39c6704737086b05e7a42a4b1b3a24a246adb67166f81e9e8028ec142fde507c2e75f3102178ee50fe0278d2c5259ecb851f2b6fc49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
f24ba8a0892fedd8a4b6db68ad7884a5

SHA1
1de1b5af1f573dc51f6479bc32b309522fbb0ec3

SHA256
cf4f6402bb806340e7447ee3eaab528e5fdf5bfcc2cb52daa1b4a5f6e79cb449

SHA512
9665eaba0cbaff0e43f697b9945a5bc256562f62395a03d95d92dc36b9b51551bc9a790bc46c355acc6c545a11b4a2c25f2925e3d32231a742d5e77fa0e69501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586349.TMP

Filesize
371B

MD5
68452eae533d7096a563a68ffdb9a25a

SHA1
d1a51186c0ca7000c293c3944f705a7183347ddd

SHA256
462f6ccfc0fda1c2b444f69e1d8b0d372bbb693cabab264fbfe6b9e19bf9227a

SHA512
c0a69812f4e6287a142f84e2ded202fd771720f78c91c9def698422cfea5df47b0ab611214d0f119121f0d22915b4439e88df1882c641a736e8836af5575750b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b7ec02359924bf6a0a6d377e07bd1701

SHA1
2c9e3e197264e87535e5f430ffd80d024f59c627

SHA256
cf43fc42ecf96d42d1ec0bec2fd97cdec9e12a589cd86e53d38dcd2fe640b53b

SHA512
3f88e97f4da6e85c643ddb78f3737f81ee50b912f70fcafa712943f3ee39e789f3f74b8cc860e555bf7063604afb49dfd6d3a0accad21e73fc41ebbfe1d66e56

Download Submit
\??\pipe\LOCAL\crashpad_3652_TQIEODLHIQKUUQVV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit