mimikatz | hxxps://urlr[.]me/kYMCyq

Analysis

max time kernel
112s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://urlr.me/kYMCyq

Score

10^/10

mimikatz discovery

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x0004000000000711-253.dat	mimikatz

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
85	raw.githubusercontent.com
86	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 774103.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 261799.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
1336	msedge.exe
1336	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2604	1336	msedge.exe	83
PID 1336 wrote to memory of 2604	1336	msedge.exe	83
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2960	1336	msedge.exe	84
PID 1336 wrote to memory of 2360	1336	msedge.exe	85
PID 1336 wrote to memory of 2360	1336	msedge.exe	85
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86
PID 1336 wrote to memory of 932	1336	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://urlr.me/kYMCyq
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4bdc46f8,0x7ffa4bdc4708,0x7ffa4bdc4718
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,7693642317642160558,105014060178910701,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4aa8bb4b-ff68-4a87-b2ae-5ebe6c7d8713.tmp

Filesize
496B

MD5
7e94eef311a6778053e0f2c7316d4a4e

SHA1
c3c0bbc8c947db2654ac5857903a1733196a93e5

SHA256
430b64782d816e293bb7a8b12e49acd5366b5f3a6508429a05600269248601b5

SHA512
ca3a9c084e988e4bb968960e2480fa89c5a6c72f1d3810138695e243a3ae54b22e4041988c4de1f817a6cf8c289652e60c19671292c7a4d5c7939097b3a94b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
1.2MB

MD5
e930b05efe23891d19bc354a4209be3e

SHA1
d1f7832035c3e8a73cc78afd28cfd7f4cece6d20

SHA256
92804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50

SHA512
a7a59176ca275d5d5ea6547108907bbe8ddbf3489308b3d6efe571b685de7e6263d36d6580abe9587a7f77adc22d3b7b164ad42845b6c110b794eaba7ab47ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f8640423b65e8df35bbeaa39946d89a1

SHA1
179a90911471aa71df00a07b893413574dff7947

SHA256
4c15853468de7d015d135c70168a6d5c2c8a5caf1e974de3d69b1b4e263f8ddc

SHA512
98d56edc0facc7d25cec280299cade2ac6ca1577b232c0db659fe4ff66e5a481384c1c574da204518d771f9aea4a23c42f6da5bc48fcc975b758c69dfdffabba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0ff7fba2a693d748731c631be9824a5

SHA1
303011447d063f54ac6e1699c13bab6432189956

SHA256
b66057f6ab6895c3ba3f1e832ca0afd07bc8fddbf618ca880187a3fac0a567f5

SHA512
33a6da0dadab6e1e0c8512f70846a24a9550579b7678b9711a6b91a573a92437e895b63b71ff96e50fc64c2b9cb9aba1a9fa95d6aa026862d48856304babe03a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3cdf282c842b3dd3585066df6413641f

SHA1
7fd101458a8ece25f50668b81cf7d1a687191144

SHA256
b341de1b92f916aea475f14f93a4a2bea1cc02fb660837267df5321319b0c8f9

SHA512
25973f018141488d7d05b4a79a4b839f7b1e86fedd696c425e6d1d4969efa65242abb87ef8c9bba9fd1018dd600922f76d8a092c1523de2411486d4d55c81d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a6da4c83ebd23d182658c99cba29c1d

SHA1
f82aebc3ee76a5281dbdc84234405870ba58f541

SHA256
8f682cde13c7c656a2f875b3ba9f2e7aa924ec1a8e10a7da474d80d27275fe66

SHA512
681926a754b5259ed50542d6b2aa3ffca25b708647db30f767d7f95132258db763188143d42d52373ed96b537d979efad49bfaa7104c5c5457b4295a4b389ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e17fb57211bb0e7810acb43ea278fae4

SHA1
267af3d33cb7d79e174e202b167a7ad8d11764f7

SHA256
0cbcc56db0f29b6feec2baf5b6b08b9f1be15a28179e47309f3ec2ea49dfc2f6

SHA512
f8538468eec6dcbd7f2c6bf8fca76a81f7834431a94c9a7e23d4de02cb3c5f1019e3249ecb5396fac6a3433b46fd297345c7eb9906a7f14e07f8e77e805b463f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
16b15fabd3d3bc33f2f3a88e942b2392

SHA1
e10fdc2d3d997e0090ee5fe5a041e7dce78fd523

SHA256
6ef02c91ed9f2d17967e9522bddf0a3f82b5adce8e8a5803163aee2a22f74456

SHA512
be483cdbd1e2ce04090b458a20a96a21d1e4061f0e0d29f6d98ad7ae7da222234cb7b24474cbb3e671a57534a15fa0efa0b6b3681f8303ab454823cef7280bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
20fd9369f7249ad1707e3a0ce7cde0d3

SHA1
7f2412a9cee302fb5704876515d09861bc6e8650

SHA256
7ca7ab8ba54553efaa8ae7080702cdecab3542cf469ac1274e511bb380ef1a4f

SHA512
11fca7df31868e5eed02c626c710b6dc3722581958f5535d7a469c2ccb397c426271c45611534a545446b3d62e10d6820ad3caee8fd65250999c26b951b5beb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fca0.TMP

Filesize
538B

MD5
e4ae930fe40a8bd651f7102608a3e754

SHA1
c648bc8169358ad8a186fd0c5844c7e81321976f

SHA256
0a66113eecf1da859dbe3430a292879148558519dac03da33d0bec0b28c853f5

SHA512
d2d3e263e2ad3eda7969e442ec38e33e811b182ff2b961fda4eaef921b00f4b339380f48a4873ba78b14a744c0cf3c0f9da7f8c9b3a75b21d6016acf55192b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a8aec7f3fcf418dc24c6610f5a4f537b

SHA1
020ae22a4d812d42292c59f6fa5e683cff4aaa92

SHA256
a5f0013b10c583977e8854e05c8125429a74b3114fa27aaacb03a2c153f593dd

SHA512
ce8fb2930da0d9674977566bf30a06afe353f2dc5b89b9f59209c6b42e5310f0168925754c30d404ddac0fffdcc889f6ddf667f15d4d59b777115f96923adfa4

Download Submit