hxxps://shorter[.]gg/iHtMAo

Analysis

max time kernel
157s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2025, 11:25

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://shorter.gg/iHtMAo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "127"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
3988	identity_helper.exe
3988	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4940	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4736	1144	msedge.exe	84
PID 1144 wrote to memory of 4736	1144	msedge.exe	84
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4224	1144	msedge.exe	85
PID 1144 wrote to memory of 4216	1144	msedge.exe	86
PID 1144 wrote to memory of 4216	1144	msedge.exe	86
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87
PID 1144 wrote to memory of 4572	1144	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://shorter.gg/iHtMAo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8204c46f8,0x7ff8204c4708,0x7ff8204c4718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5958634706671002448,2774115669397980655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25f87986bcd72dd045d9b8618fb48592

SHA1
c2d9b4ec955b8840027ff6fd6c1f636578fef7b5

SHA256
d8b542281740c12609279f2549f85d3c94e6e49a3a2a4b9698c93cca2dce486c

SHA512
0c8a0d1a3b0d4b30773b8519a3d6e63d92973733da818ca9838599a9639e18df18ce31ebf56f46f6bbb7d89d10c726f4d73781e154d115a6068a3be7dd12b314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
94bd9c36e88be77b106069e32ac8d934

SHA1
32bd157b84cde4eaf93360112d707056fc5b0b86

SHA256
8f49a43a08e2984636b172a777d5b3880e6e82ad25b427fef3f05b7b4f5c5b27

SHA512
7d4933fae6a279cc330fde4ae9425f66478c166684a30cec9c5c3f295289cf83cbdf604b8958f6db64b0a4b1566db102fbcbdcdb6eca008d86d9a9c8b252ff16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ab124d6005f255ba1f8513b85f43a92e

SHA1
9bafcfcc67a5100f3ff4ea0bbc17d96868847ea0

SHA256
1ab9963a06313640d538b071695a297619627ecafce23968fa1574b305f45e25

SHA512
61829d2a0d01051418786cd6f571dffe744b473a0641345faef6b3d6392d78770c9b4978cd46d9da657ef2fd04d8d7a0da3ccfb5085eea313a728fafca3fe82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
b5f8cc31330a02294acef4515a0a025a

SHA1
6b3468a143ebdd9ae775d4bb7b26c283ca8d1428

SHA256
47cc0a7b436b4cfe641919189e0575f7e08a382088fe08c76fe31cf574a742cc

SHA512
28db3bc3b00640887b2f1650747953fa1ba3161af2dcde9f14c068f620eb701af913dd0361cf62ef0827033385ff3ab1340ae73e489bd590cc4fa04fd1d9d86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
31f8139d2f3038196447ec1e72378ec0

SHA1
eb727f7f4f1b13e84fb53d4cc6ca0e726cc6779f

SHA256
ff9276511580c85b5df4379885ccb35841f18b7e1ef667ccff6cf66658dffad4

SHA512
6220d77951a725f123453e0c26dccf63d3d5f4dc52a28594b35fd79e653b7c04c27db6b0bc6df6856a4b093f6cfe4828da1fc65ab080267567f1c1e0108bf583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1e2be8eeaffbfdd5925760de69fe5b6

SHA1
ca2b3b241bffa4179b27ca0901dbfbfa6d80c21e

SHA256
16fd63341a7cc0d3e9fc4b79b68674c4e9915cc7d65be17df884119f0640edc6

SHA512
44ca697b7c3013fc0ade5affc6cdd0d346feaf6cd5678899f7ae3f71e102224970903a300f6f05462978ac6ba1b9a451380a3e5b9c7fb695cb80bb68fd8bbb51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
640ca89702bd8cbeeac42b131df3e8dc

SHA1
a36af7ca70ecf3343b590152efbbdeb6aec16b62

SHA256
dc2df80aa45b9f944621f9cf49f316e1fe6e91263128c9ccda5dd3b1ac243957

SHA512
ba79e9fa6d472cd5fcd347c06402eb3e5f30cb5af36e33eabaebe3a5dcdcb685a1e5f7cd96a91f3c7a96db6c7cad5209a16358cd7f7d49ce5c6bf46fee428f36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c497a92d52586e5a8927fed50ea27ec7

SHA1
af633a0d15451cd8f655e2b4f9439fb765987d8e

SHA256
f337edc3a3e835a09fbf31dd37a8c74986df293797b9ed87bd9b2bbfe7c31d72

SHA512
8163298a009e71f369ac4d9f02053cc6ca8aa11ef2e4e29a3f13d8a3c43f0a67ebfaea331075f4e9b6b323acee8f71b58e96491133c2e27789b991761fcc4e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb0142e70ed27a20828a168b5a832db5

SHA1
ff0d9a0a64d7028002c01fa8e51bab2076e8ae23

SHA256
4c62caf2e9219e736c3dc58820add0967b18f2afe1054a49be2a5532d4199002

SHA512
29a13c55034fda565aab2359dfc77637ec0e28ddeae22e5f96b3dca791f2d3569d9aeb5e009cec2c45e5e36c24ebd2b31638389559a3b414c91a7d00ac55d6ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eba9d8fccad313fe736c3c985e07aad1

SHA1
dc83539daf8395cca3b0384abadcbd37a8e7b7be

SHA256
3ab8b645b63d958b673e1417252e342a2256e3b407c2244ffc80e711d90616d0

SHA512
ba66fe34e87f75f127b53ed18740423cbe293f590bd13a4c3cb1189d8485651f1e905ba6b0e92d2ceed8b03b8cbad086a7e3bebd3e8d9f95f2c47ed206366f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ff765fe827701baf3a0418bf9c17394

SHA1
c5d41063f5920845e4bf7eecfd861b9adbe9863b

SHA256
998790f6db82bafcea479d480cd9c30d5417fe9128da5826721bd30a5fd59846

SHA512
56db0dd79ec53af0065875115db5308bef916fc40c59389d6f64abb90fd56973facad53380779157685dfbf8a4c40e55d8d47003f8e0a05c0b421fa9d4680e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fded3c66607119fc0048cc9ce3c41208

SHA1
2dc7c959421caf3acd0bc5187592cfa7a1a2d822

SHA256
b1fc5ad8ede5d5e9825c21462f44c5bd6f448f8fbec03a8db18b14807c788172

SHA512
e849cde28a3999de9acf3245fa244b7700c5b093a8a8d8e2ef2fdc0a914ded11def2a5783ef23f32fb0c8f94855f56363fd55cd4df8307447c5b54b375462df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bdb41dcd06992d31db486fdf2a0277db

SHA1
c020efb906e50cbd48f3c57844c340356f5471dc

SHA256
ab39bafdb0e537e2a264666c149df70890cb5d4734958ff130ffa7a6eef02762

SHA512
3c05971920a961319794d28538095bf33970a35c2ab7753d639bba07f0ebb94fd76e4066b77927d33c245524ec31233046c1de87ffe199053cdef8b8a32d3462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58772f.TMP

Filesize
1KB

MD5
58e2b77620a8940d5ca7034aab5048df

SHA1
eda13c0c74f625836c64da06860fa352bf1a8293

SHA256
775963c95a4831ad392fdd7738bebbd09db42576269142b49e0493c1f4286ee2

SHA512
e2d4a71b6e7e1a0ca2bd1c2e06f5fe7297b5e95cd09d817f3dc1d8b7c722f3cf1f92820990d5eef90f27d3c8b0406b71a74c6f75a9c761b94b3126e195214522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
89bf1316623e749715c6e56cd8dbb96d

SHA1
7ab75746fab0cdd4084c0072b55f612a8dd8d04a

SHA256
7204e0732db55567750750beb2c8550ad69fa927355d875d3e5a0f423f151957

SHA512
a28f943940fd1b0e24c8db6506a61edec77386d1470cb78ff81e889d6113d4935b8f93d4bab759d2cb14a4fa2a7e9686d4951504137bb1de5a8e8285a76652e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
803d29b2c1bd0f09186885ff9d6acf91

SHA1
55cab5e4fd6f004e3682edab5d990d16d3a4c914

SHA256
c935df885183d4bd9b8f62a01e5a2b3cb3bddca40b3a28041966ff380fd8658c

SHA512
4061c6fe99958604ef4d5f96c4da347334aa6acd69bdf56841ae7d92a4f35449f859934da5c5b4177cd526ffc446b15f555a8b58c0e49041d47ff2d2904b8b61

Download Submit