hxxps://is[.]gd/AVajCp

Analysis

max time kernel
385s
max time network
372s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://is.gd/AVajCp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
956	msedge.exe
956	msedge.exe
4040	identity_helper.exe
4040	identity_helper.exe
3504	msedge.exe
3504	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 3872	956	msedge.exe	83
PID 956 wrote to memory of 3872	956	msedge.exe	83
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1408	956	msedge.exe	84
PID 956 wrote to memory of 1664	956	msedge.exe	85
PID 956 wrote to memory of 1664	956	msedge.exe	85
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86
PID 956 wrote to memory of 1496	956	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://is.gd/AVajCp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf3146f8,0x7ffdcf314708,0x7ffdcf314718
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6812226879841945384,6759641606806618976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
539B

MD5
b86200fbfd04b101bd63b369b3d830cc

SHA1
4243c88d84fff3a60ccb07f97e7f4eef51167344

SHA256
0d4c0445d45922ce0bccd80536db4a63503619d82c518a308c72e8d0d61f851f

SHA512
9a46d348b6746b68cfadde932f3c9744c9e6bf97ae743b70138fd9a2f120fdeb45057e8dddfe907148d417b1716bb6f45625a4453781f467fdb628f01174f01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
539B

MD5
6e1bca19839118914384726c7b01f57b

SHA1
b235f808380c50b4e909b5459b13fb24bfa08875

SHA256
a8fa37111e3dd00d29bec1a4d98c59993af080b038e0ba927912bf76b6cabd46

SHA512
69998012e529324b698e0beca6d09d064851bcfc9de69cdcb307cd4a8c889d97acd5eec5f7e50ae5c62bdccfbe229ccb56647e69323a2cbd0fe5cfbeb1946abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6dcda0b57ae83a719b34e012d33a440

SHA1
4879447a2a937bd279582b58d033d773944e1c28

SHA256
0f6a7b1b74e0d4f8d6943f3a1f5c5e82a4eef6d770d6048ab08ae2f27fc6a344

SHA512
d8ede9e3f311f80fc1dca70c4873dee5652ae7aab3345501643b4d164eda8c10ebd3039ed2775f500381aef18a6afb35f10cdd07fb84037388a5c3d7629d22e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41c89c55900fd673f292ea1bcd9564a6

SHA1
94ffe512fd2e9d52c65c5b7c8be42b910c97a9e9

SHA256
a5e1da72e6fb65e061c3335dd427127dd32cb9ceed50ee31afc4be7f94b69ed2

SHA512
1cdf5bc9cbb018876effa127e36ac303d207509cb74ad41dd60615c0631ba4eefc3a1f2e8f7e31435f208d81b23e249b3e57c151f653ea021e9db45660b0ddbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83777d9b8620895b886c384cddb50b63

SHA1
48d2d768c77cf4665048a92cc13adaebbbb9216b

SHA256
3995122017ef70aa7ba5c1f524889f914a6f646489cdc11124fb472ddb4582b7

SHA512
b2365659ee984408f3860731700058a53632850b220056d1a476d070eaa948bb2dd5e85807db25b05aea6f9abe05dd76a623835538ba9905a4a8a81963773207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a4aa6270b26d2bc61a89d6c6aa7ec69

SHA1
a8ea52cad070441983ae56227c14812dae058812

SHA256
583295ff8f071f89b36d1a73c5ffe3faf43157703edb9ede4d6ef3812cfd5fca

SHA512
ae23fe7435aa944cb5fb4b3a3bced267faead1928e0cfe3a6259030c71d849c392fe426676428deef1d0a692f943c49e02a22ce099710ba2fe474f6de0a749d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e85d2f0f454a5f2f69de9bf69dc71061

SHA1
664ff1618ec683b92666d9a9397f731a7686989f

SHA256
ab23578e07bde97d62ddee9574eaaf02516040925f97b0be20d78ccb23fec524

SHA512
df63e21ec504d1804cfbf9e50e6e585037e6a51c2113a852fa24f9d96cb7aee3ff0c34b3c22439cae10667b6a4b3c1cd7258f3771cd8fc53fd1a3861803a213b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
b3b5874b6872d0dbd0de0914ce03b246

SHA1
64c1757f5748f384e2ec886a95d2c1f176959164

SHA256
1909e963421aac5310cb94dbf61a461f1f0b17346deecf94887368c70f1886a8

SHA512
d3895bc09d36e4ee5a612af9fd9f019fa50b7bbbe0f89b042950078f159b3a012e654ae13990e706aaeb11ba9f434ac443355a7ae1854a9bce3b663a376e5f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
8a5c360b35c44372a87c221f0cfece64

SHA1
264eb4a648c4a12dd802d24b92dc092620dfd7ee

SHA256
a71c937cd1e54a46b6cca4e4e4436388ce96635f08b6eef655f6068c89fdff49

SHA512
faa72f12ce3b3805887f39e21df972ad24073dbf8bdf2892bf28f0a4a26220d16a5b372341373e91e64d003e0f874787961c982e3b44458aadaf2f8691637427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591beb.TMP

Filesize
203B

MD5
f783b6e78a6a830fb75a4cbd6265b0cb

SHA1
1f1bec35139e7d9e4e5fe00cb19b9c43bb6644c1

SHA256
ee97ea3b29787337861fbf383f38de47fba06b2c09ca4dcc7c82e81032e40580

SHA512
9d38b306fcd7b86b0fa60b64bbb1310e9b9956ae1b5fbd92e1fac8544a47c476d807423daa0393bc7029356c0b273cfbe0880c3b458d07dcc472691750c190d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb46b13430e144753479ab5819409d7f

SHA1
82241963a92c732eaf4cd50148cb2ce2110d7a90

SHA256
b5e730349336a73dae4bd292e039f88ad403f015c1c62574d1ef04b3e828a043

SHA512
840c042a818950f38d4978c5e7040015202440985f953e49a634600e96803176b424220396f222057781e19a654cea03690441f3b9bfb52a9973a49febdb8323

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\89421.htm

Filesize
15KB

MD5
7f4ce7a21e456b06a6b1cec5522019f0

SHA1
9573c7b7862da2a1be57a0b6d8bcfca8c439317f

SHA256
f77ed2d2bff604ebb559936702dbadd47ee3b64f7d8ae50d7e03d5c18a304bfe

SHA512
69d8b7b367a0a448dd5b0d53698da65de4add9f5ba9f5887c5e0b79c2a71fd99e159f475f7d1885ae9e21d5827dbfcc78e101c8855ebe872c406432b884e4675

Download Submit