hxxps://form[.]jotform[.]com/232147821038149

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2023, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://form.jotform.com/232147821038149

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
1120	msedge.exe
1120	msedge.exe
4476	identity_helper.exe
4476	identity_helper.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1616	1120	msedge.exe	81
PID 1120 wrote to memory of 1616	1120	msedge.exe	81
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 3816	1120	msedge.exe	82
PID 1120 wrote to memory of 4272	1120	msedge.exe	83
PID 1120 wrote to memory of 4272	1120	msedge.exe	83
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84
PID 1120 wrote to memory of 2760	1120	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://form.jotform.com/232147821038149
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd67aa46f8,0x7ffd67aa4708,0x7ffd67aa4718
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,645329703670543942,1249755258173808484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f165c2b5331c6ad023ad1c6e07f986d2

SHA1
b9d1ac7b80f2bb27f4f2052e9a3536466d917b19

SHA256
8c0e98afe49dae11f5002ec442e3d8f9928f032aac5020eeb6c6b525197f4e86

SHA512
26bf8a49ba3dc90f8324645f3f5bb9461d41bc78f760a97d48e414453e289d875922a2609b657c6e4ab978ddc02330a69d32cc806b80caa525ff3aea7a1abaf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
4a12f8c87df55dd0916979db5c6024a2

SHA1
06762d959ffc1932e4f63bea6206b5df1f8c667a

SHA256
b3fe26410c1442b493bbee6d51f77e85408b0d46a13f2c5df279ca27d5fa318f

SHA512
24520861409969a77a1df86f34b864c1ba16f030e9d1bd10f25eb1355ec340c51699a7f6e8615422830befe7fed07efa54e39a3dcf77a377c7d8ed64b49b468c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8432772be78c0d747c358b0b96970a37

SHA1
fb5658290654cf1cc0bdbfd85d39a54538c84530

SHA256
417e0300f8a71130055ee0897b93c8b2f790b3be999be3a514c346ee6991f1e3

SHA512
0b08d44a011f412c2efdf207de03f6f3da995acb71c4c100826b67a7162397b5bc122989a0c305daff60bd216520e2db096af4b9c7a50a068bbaf5b4058a95a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
11f04ac54a8475a54c5d7242b7790404

SHA1
27e4c200bfbc4192244aa5b8d55c728ef1ac239a

SHA256
359702f278c94f17fb13fbbf20e214fb98fbfd69d3808d6aaede77eac6057c54

SHA512
9310443022750c957e4c9acb1717776610c7fe6aa8fc43dfdda56711528f4281aa61f847bba95361f0e34060ee6f2e9393d499190e5f0d9db4c8bf041a45db6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
66f6a80d7b9a291f494afa351efd29f1

SHA1
3c64421a6cfb49a1e56894119c59eef7ef19f580

SHA256
bcf4cd75d10ee02d4b463e276ece385e4c389f4ab3958a55e9700fa5b4c565e8

SHA512
0f7531089f5604f0136c82d53fa6530828fb3c2d3167f47babc57d3ece5b13fd4fa6a6e01548626ab790325c52a3eca8e2e8003f51923c7dd592a4421176a139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d02d337ace931190822e0499ea030c3

SHA1
9e169140fc90ba2c03bc4ae92b7531be19080db0

SHA256
21bec0d3adfc4042d896d23d1d94c5a00f916380caa7abe3492f869bcdd8ca95

SHA512
c9f25643bb0814cf41fe1aec12fb1d9279fef7843ac444ef899fb7cfedd1655d50d502674de290aee7ec0e8b984e41c80c3b0768326d3d08a3985e5fcb1cadad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4cc94fbe675dda1b6cc4c6806358868

SHA1
1a0fcde8184e0dc4610ef02c93b927d64346158c

SHA256
1e9c32988dff8c5da5760b77a978148f2f8c9948b7a962ee0800cd3c710b743d

SHA512
5cdc80b6dc6083c4592dc7ef31d0abf17200b8938d82fcdf7f7030695d8138e98ce975dc77181226ef287225cc6506932f22bf598ef761cbff82cd31bc54f1e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
200B

MD5
ba667957078df58530dc95fcb1bfebef

SHA1
9350abf5fd476f506e0d8475faded681550838d6

SHA256
1d298b183cf9b2ff002bf3c809b344800580879c4807fec6fdd1dcb6901408bf

SHA512
4dabf72422ddd889d831e76684c031c9f55c3b3689e69d536c00b3d1c2fd9302d3fd76fe5893a7f80cdecd958353fc9fc572cf12d418c789c9fa2e00634835af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
852B

MD5
e6f85a44b2b4f92705c0312ca7450f20

SHA1
32fb9c72918669b8c54de43fb076f95ed32b4356

SHA256
5d7b89c5a27db9ae2f7eff8bff2070cea2c9e30cd7a44d00f9d2d4f4eab2bc61

SHA512
a356ca0d5be84d4634d4dab15fe32501adf7634f317edd673d5b7934f7cf40ebfaaae4bf7be2b9317d18d0c6309a6a6a500f8df5fe0db22c74b41b43926186a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
852B

MD5
027253f235964fb3f365dbf75d149a12

SHA1
8c0da43bc50b27cfbef42293537239c81bf15e1f

SHA256
b7a418bff3c927dfa423e5f656dc80f2dcd1b0cb5af44832a2c0057b51f45105

SHA512
b8ea7275529141e51bb404bb4cdedc313708a04cc28cce6a5541cda57fc62c24651adac462e2f5b861238a88dd75ab2c1c0ceac3d5f09a6e3d2c6b53de1e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d17c0b09-101a-4bfd-8ace-6804f0f005a5.tmp

Filesize
6KB

MD5
766fabfa5312f463474cb599d74383a4

SHA1
5348bab2cf9bac9a02c77cd36121116c8adde149

SHA256
14265abecaef70d6cd2e133a7bac20a3978781c994effa9ebd2c9184ed691b2e

SHA512
5a37c93e70844338d22962ad171ddc943ad7a3f241161ae03704a86d0b4664a040b5044fef267f6b2b1228134c2e22e6fe1e4673da312e3c784b9c732ded6646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8cf18c1d65a737a6dd06ecd68ccc2411

SHA1
c8d22d41f61418d1e3e34478bc8d78f4c21c3401

SHA256
73b61cbb5dcc1f68eb73ef3c740e2635f35a4f804e248a3e79538a763f9eb581

SHA512
a03580a63799653e99207b8e3cc263197db2b99d1b8526ead2b4921426299cbedd3fc43df6defcb0c35556eaf64dda327ff337d9d8176cab432110c0c80e05a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit