Analysis

  • max time kernel
    1167s
  • max time network
    1200s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-12-2024 17:15

General

  • Target

    https://vo.la/PIreNL

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://vo.la/PIreNL
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffeda43cb8,0x7fffeda43cc8,0x7fffeda43cd8
      2⤵
        PID:1476
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
        2⤵
          PID:3068
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3128
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
          2⤵
            PID:576
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
            2⤵
              PID:972
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
              2⤵
                PID:2100
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                2⤵
                  PID:4148
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
                  2⤵
                    PID:4768
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                    2⤵
                      PID:4776
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1464
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                      2⤵
                        PID:3192
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
                        2⤵
                          PID:1436
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5064
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
                          2⤵
                            PID:768
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
                            2⤵
                              PID:3104
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5788 /prefetch:8
                              2⤵
                                PID:1964
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                                2⤵
                                  PID:280
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                                  2⤵
                                    PID:4992
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
                                    2⤵
                                      PID:1068
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
                                      2⤵
                                        PID:1444
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
                                        2⤵
                                          PID:1956
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
                                          2⤵
                                            PID:3152
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,417334126707098623,6596346945090992556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1256 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5020
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:2436
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:2396

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

                                              Filesize

                                              1KB

                                              MD5

                                              c6150925cfea5941ddc7ff2a0a506692

                                              SHA1

                                              9e99a48a9960b14926bb7f3b02e22da2b0ab7280

                                              SHA256

                                              28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996

                                              SHA512

                                              b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              c0a1774f8079fe496e694f35dfdcf8bc

                                              SHA1

                                              da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

                                              SHA256

                                              c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

                                              SHA512

                                              60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              e11c77d0fa99af6b1b282a22dcb1cf4a

                                              SHA1

                                              2593a41a6a63143d837700d01aa27b1817d17a4d

                                              SHA256

                                              d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

                                              SHA512

                                              c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

                                              Filesize

                                              4KB

                                              MD5

                                              aa73868d25bd49546b300991d7d0d0bc

                                              SHA1

                                              a5c484bd1f509b191ca56566c001563354c7e912

                                              SHA256

                                              823d2c401a53134f6e7c6f204ea682054ed07379e4c1055e84cbd32d5f9d7919

                                              SHA512

                                              0d90a707f3fd7c9da32af949a1361b66e0f6fd9f4e3900fef8dc956f3f0a87b18a623e35205c575fce7650b53aaf9488360c5c900e4a79afda9f27d6e7ab500b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              2KB

                                              MD5

                                              454ce4cb034461810c069f7f265411e8

                                              SHA1

                                              1cb54fc4e045357c9ced4802018fc0474549a2f6

                                              SHA256

                                              e9ff9fc8748f9f1af835c0c1127cd7fe9b25f68e5ecafffc7b53a77400464e2e

                                              SHA512

                                              1c969b7b09b2a1e510138b5395f23ee02124900d6faece162b2f8974a1b727d51fd559ba6448243233c8dfcf7688fd29ac84f9840ba3d8f5b9f36d97184dbb1f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              4KB

                                              MD5

                                              e8acc72cab18a67c90492d2db96fbb4b

                                              SHA1

                                              39397c201c7c8a571c7e820a338bc8b7b3d2f624

                                              SHA256

                                              7a6ed7accce668ea245843b587a183e453ddb23e25ac8005d2e3a6aae4c4857d

                                              SHA512

                                              58a2f7389ac166a5acde4573e274f8124a784bf21cd94877b90f4923f83156b1b7220209a2367cc338f2ac89dc51a6ea24d1b86e1624a1d0dd107aacb2d47360

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              891B

                                              MD5

                                              6812748fe7756b9beb8816dd3a099443

                                              SHA1

                                              d2c965a13ebff808a0cf6a05fbd3d19a4ce4b392

                                              SHA256

                                              5fd3bd585c68a2cd05d592e22ed0e80dd36995e812c7e08d2a751870c177a861

                                              SHA512

                                              7102c94f703ca4219719f4812fb71c922e1b5cd49e5e82abce43f181636120e86f349f7c680200f45375a2ec0d65e9c6ecb68a39a0dcdac211186996774713f0

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              821B

                                              MD5

                                              927728ea4ffb343f9a7ce8f969170d82

                                              SHA1

                                              9a41189653d20b09fc1c11306272a7dfae95c7d1

                                              SHA256

                                              70f07113f3bb2a0cf4d1a278dfdab20bb9f17b9ddd45c99e0c0c74de49049845

                                              SHA512

                                              814bf75d53a0ecba10f01b14dfe409046cae76769ed02bc8a8661ec4da50e26369ccc487c64187d242921b1cbfc07c7733dd6ce1f7732e9fbf6e8eb2a787980d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              9f48add444a9c604483adebee50a174a

                                              SHA1

                                              37942c08ba253a21f6467558b625b54f0e33c5a7

                                              SHA256

                                              25c8e2486fba1c38f9d7eaad9abaddb33100381e4d30092c177c2f4faa9d4280

                                              SHA512

                                              75beccc62cdeea4909f491a6e63abd76ba685305e519d51e3c4a50a8538d5834ae67e7cf111599eaba1204be48d71dc9a1a84042a838f9bc03511355eaed7da6

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              fe44f44446d9169a9c5cdc003b0c8f63

                                              SHA1

                                              43f01889724f8174ceeaae7ba12f006902995455

                                              SHA256

                                              6550fda063e6e16b79b5427c086c9edfbdb1ddf1ed9d36c88d24297d55517e69

                                              SHA512

                                              243090e22ebcacaa2311643f8b4ac3b8545c5b6c84858cb18c0ad94130873a4359b74bb957675a1503d31d40da7eaddaf60223aae3cb7dd7dfd93d0511272bbe

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              261c6ea2ce4ccde7cd4501d11d60799d

                                              SHA1

                                              1362035fe5543113abc16dbc6045a26badb1aedc

                                              SHA256

                                              a8039f98d8cfc049402caf82aa9f35a82454a159f0be439b30c681c66c14eec3

                                              SHA512

                                              0ce7be72f1548c1deb1f819fcdf2221ae6ec4d5ab18073fa3654361dc6adb1b023b223b26663412d8243bce7d624408f58b9ca584e173fef0c1139641d2c8da9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              b819b3fcad0891d241c9b1e6c80e5324

                                              SHA1

                                              1195d0dff434653b34e07dbe811bb5390ee6526d

                                              SHA256

                                              3c2d59fa656fac02397fe0f0337fdcf91d03d2de51282792e6ec7ce35461f8f4

                                              SHA512

                                              0e8996017754b77780160d960d43b9da91a3abff7b9ae0f14edd1b1138eefeda40afefd9cd1bb0587147df1cb05c574f39077ea6fe94a833e68ddbac2d1c8919

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              d9e8aaab496f1e35acf09f825ed44e68

                                              SHA1

                                              eb97ee0560e5caeb95d84b2005041910bc73f3d3

                                              SHA256

                                              2dc214d65527bcd26aeb6d021cdab0300482a24895068f287c81f4a473d99b85

                                              SHA512

                                              0e3cd525fa83d4de5dae6af5a34cd39b1fc20af61c416083d1db30ed318c4aa5839a989806b7920e503433cbdd8f81400a95ac9e7407093255153def5c93990f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              d8319fc674f3fd55b2f78650136dd95e

                                              SHA1

                                              2b71b78ba2ca76c3c6c4e9d421590b20a23892ca

                                              SHA256

                                              51eee26b051b6e218fba6eaede1e080d7d5175b961cc390e4f50c94daadbb8db

                                              SHA512

                                              89393f622c86eb50c3bc144784ff7fd5db26cbdac872380fddf6571006211ce03b2ef5ba773e05d853941abb4fdaa583b41ff744fbeecfbb3fc84c97f4b022b4

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              76511eb1bc4c7853129236e063c29e37

                                              SHA1

                                              c1779fc2c7c3ba8fa1633a44d4034d28f48e9fba

                                              SHA256

                                              8ac7ad979e7fbba5bfcbe50384c595ac85fbfcf5f61d4d986e6f93b9921170f7

                                              SHA512

                                              3a893165570c348239ebf553b493872c71034d9ef9f696797fd7d0c983e55a495cf63b9f07637c9d44fbee53b6921f70be0ab1a46f248cf8670d1728717eff52

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              41ec58cc9110239e722e591f4e29d00a

                                              SHA1

                                              2b7e5b4341f807840aac17210288da91b99f16b4

                                              SHA256

                                              d83834f225b43c0736495ae2691a6cfafb451315183ef5d4fee614afe2fdf5a9

                                              SHA512

                                              419f8a28487a9f6d1101bfb79a25c2d72e9cfce0bcc65c17ee2beb9909b52fef07df3e7ed6ac444c9464e68e76565bd99f8a0e73505f2a7f08d1a466d95e6ffd

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              2KB

                                              MD5

                                              d4762a1ffa7f93243a1b971d06d0802d

                                              SHA1

                                              2c44e651e47bcd68e49e6a574a380485b7939f2d

                                              SHA256

                                              f4cb2b919fee4815f7b33d33e50917a418aefd4af028d095c5a45b798ab2a333

                                              SHA512

                                              ce7c55b97c9d8838cea3f6c2c3a829dea44f258bf3351a851b9acfc22c529d2098e174b6688abb33142940db2bf0c8c5f0d77a8d267acd86f5c604edf2f819c7

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              a7bc6bb3d0bc032013e559a157d42d53

                                              SHA1

                                              aa0f1a2b95d632e7d24b8ce420ac0cea130b8080

                                              SHA256

                                              18988fef462326f0c1ea09f49d8542de2ed5ed16d1c168463a815915bf7d49e8

                                              SHA512

                                              69bb67bc198c01b65bb5248363e82c76eb6f23c51a7f68473ac4c0feef528881d1c55ab456144341e13fa179e7efa4a596b9879dcc54672356fb14aec4e83f87

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce9a.TMP

                                              Filesize

                                              1KB

                                              MD5

                                              04fac5cf62a52e2af2fd43b40dbc3525

                                              SHA1

                                              94c7acb4b743a312d8fae3a3994bfea05d06ddda

                                              SHA256

                                              9ca76209743267c9ec15d6e136b85b9301f8cc08ab8abeab9d65b590f8510aaa

                                              SHA512

                                              fb7dbd9167fa52661c0f2f2601878e7778ff049b95d33067b220b86815776738e3f4f8e4c01b6c4e404820ff0c432cf55759fdb53a09b38f7918e7d405b7ed20

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              1dab60d557986d20c8b75a640a1afbc0

                                              SHA1

                                              163d6f909186739c3950c6fc29173394b6d41d57

                                              SHA256

                                              d48da3abdd28749eafa25c2e4683a0964ac3fa4ccf71aaf4c56b61a820d887ab

                                              SHA512

                                              a326539febf729179597cd3add41a9a6eb8f07c8018b9a9875b6ceedcf6a639aec1dfdc660f237f0c5dc80653b09142449fe787ad3d13747c51d91dddfba7bae