hxxp://internationalqualitylearning[.]com

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://internationalqualitylearning.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
4592	msedge.exe
4592	msedge.exe
1572	identity_helper.exe
1572	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4892	4592	msedge.exe	84
PID 4592 wrote to memory of 4892	4592	msedge.exe	84
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 996	4592	msedge.exe	85
PID 4592 wrote to memory of 1128	4592	msedge.exe	86
PID 4592 wrote to memory of 1128	4592	msedge.exe	86
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87
PID 4592 wrote to memory of 4500	4592	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://internationalqualitylearning.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc499b46f8,0x7ffc499b4708,0x7ffc499b4718
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17201691412974518481,1259097908065291043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
620b5896631befc4a7e91acfccf24438

SHA1
bd5ef48dd0837042fc31eb83e4386e0993ac47c9

SHA256
a879320f4687a2dbb1df1cfc93feefcc2f0358e250fc55be84a8b23b862b9574

SHA512
b5f50bd7c3397950f081e45f0346967e531c79d95d0e2f1efe6e026b93e578768edccbe4da1084ebd66d7ad42b327e135c189298b848fd029872bcebc0a41520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
1fb22070716f3206b560d7900bd341d3

SHA1
54e3f607a8f4e4296bf395e6f49f6c28b80b1e81

SHA256
ccb9d261a8c15a7511471369ad708d2dbba5ab4d9688e933fe25ae9d3cd245b0

SHA512
04fbc667f9b0967bef9bbd2686c5d7c17d6aed1d089312815cc84ca302a42c77b746b5fec2356e33710c9803759b1540838ffaaafc5a60c78976132c439eb701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_universalqualityseminars.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4b4574f127898d39d57c8fa049a2b621

SHA1
b03ec069e28f156ad5dd75434732f30c2893365c

SHA256
94e16e20a61eceac5d83ef6fd42731f73c0c775ec6d4e54b66a2131ab8f09e9c

SHA512
ae7f841b024cf4704736778f9379f7e72e3660fb3c05dc7616a49c7c68cddf79d54d856cb996d3cbe3be93c099e1dc693dd4d527999eb4c049291fb1e5aab164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bfa571c1e6cb2c90ef43555d0c83c418

SHA1
04fce4d4d3232b7c1978a1a63a244b6f4fcd7c12

SHA256
76dc94925c14a9767f7d522f8675e40627f07f37da34325937dab11b1b3b8d7e

SHA512
b98110e6b642c76aceecd04e6bef5cdb98b737726b26f561b302e0e7b948e86f647d7a09b20ebd13c6c9e1866a87f51f50e2d885b84baca67d6cefe536b478f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
264a90e82abeef1d630353c5c0222678

SHA1
da5ec431082c22debd0e2b1f373608a07f171fe9

SHA256
a6f0a1e5461ca559f21dfcc1fb0455f19ba5ff2586b54d65dec034f82b9a3eb5

SHA512
e25543b931e707561da6657dfef540cd95b5a199d24de3f6f3738bcaf81d3b721219c90d81630dc314c2ae2d8245358c260881e23705294d8dd9fae86370d0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9402f81a38496fd400849d35588d41ae

SHA1
22f6a14e524419c79dfec77fa1741c562c62ccad

SHA256
7789cb2c1cc7731e9c800536cf1800362dac49aadbd2687c37110009b6a7f263

SHA512
9478489e04cf601b839955a2fc504e2251e2d22e8f7fce78011f1131ffdd36e2369ee475f368c7368085191c0e1e950d2e77720832e4b7cc9a4330a1ff1db2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9d771363c15875e4327871800f42ccd

SHA1
b330eba0f5908385d30a96a22c3ca8a446b9ea5f

SHA256
2c4ca59d2aba54c7615d4c508cda977e0d28641bbe9ead150963f8659e2e67be

SHA512
d512adcd63f190d7399ab5e36688cc95a9f4fcbc98bc11d813b1a2975b0ff4486a29fc35c032f5e61d1505caf1a6e364cfc632a3ac692bf0f4157613fcc162e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
60bc264efe5def581558c95f2a6b3a7c

SHA1
5a302a4626a70d553cf1c420e13655d7cf0ec6d6

SHA256
db62d7404454c3f0ac6bbfb120aba11bd0078fa550df63d85133082e5e0ac378

SHA512
141c7f2cbd711eeeb408ba12228bebe1582be8e6924b98345114b58853a1768d6400c7771aeb67df34152e64a295a86ad9c58474b79b89f1d80022d33c371d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
408c38696782268f761fbe9b179d7290

SHA1
17ef559b3beb6c885f33da8ca70478bb572b1549

SHA256
8d05341869f503d72ef7ef561bf82c157b637681c2acb44f7c9ff825c6818253

SHA512
a7e0775b9a54f66312f9ca3840eb11812306274eb6bf878edeb03eece38c0878d453bb56f884d6ce38867d40e83db0e71bf07eb03b0791046822031cb671ff43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\525685f66d2fa04fc43a1dd400def098745e9813\f386248e-f6b7-4d72-8dd7-77ea95a8bedd\index-dir\the-real-index

Filesize
72B

MD5
09fb06816b13bd61ff0c7cc88e8dbbe7

SHA1
c67222cf3a3778310e55aa2bf8e6d2d1773feb28

SHA256
ee0040cd8b0e478e372a69927b5d46054ff1b04f34495c20ee6c11cd6d15412d

SHA512
6fcddff2fc2064cc9c18946259c747a8dd802efbd9553260099cd7dda76e918968e2300aa1a006a5fd56a27eb2af825204bfe4809efa88b587ad2115a4369ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\525685f66d2fa04fc43a1dd400def098745e9813\f386248e-f6b7-4d72-8dd7-77ea95a8bedd\index-dir\the-real-index~RFe57fe84.TMP

Filesize
48B

MD5
f897bfa00abb045762e0b116d42da0cd

SHA1
5245cd49e90c0ccb36a336242dcbdf77aabcf4c6

SHA256
bb22b1b3a8e276b93d172e602ddf23ce24ccf74f4594e64a70fc8051018303e1

SHA512
4d7589cccb4964555c1e8618a2cc703608e1fd69b7ad8acf984d6e5eee54549de7efa8364378845d0df15d1b42ed02a2991d3c93e2ff810a08a2d947bc3c54d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\525685f66d2fa04fc43a1dd400def098745e9813\index.txt

Filesize
217B

MD5
b782071d47c1761d9b9c790cb8f41477

SHA1
d001f472ab405626c3ea6975593049734181f876

SHA256
1e7d578ea636324ffbae94d9a9d9df16c375432d2a169791faec5dc61c864417

SHA512
018715876d48fa7fe573d77d25310d61f13132766da33c7328e572147c45f969fbcbfa286c85b43dfa30a459a5ebe864adafad278ea79ee96c090e91c3b9120e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\525685f66d2fa04fc43a1dd400def098745e9813\index.txt

Filesize
277B

MD5
54a9d4ce2c65f1ae79dcc1b816b817d9

SHA1
171a12538926daf31652cbe56711690ccf2195d0

SHA256
fc898bdefb0b2b9144925371d42c8deb5e9b2480dd17fde39f7f72abf40e6872

SHA512
6a1904d022175d87ab0e2766e64ac9459f11c3c4c57a570fb30514e6c42633d5bb5291265660203556fc23f397be2dfb114a1083a74057d24231b81acffd8c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\525685f66d2fa04fc43a1dd400def098745e9813\index.txt

Filesize
151B

MD5
2f45406b30867a013b3657013adc48ca

SHA1
6cfbb77f0889f2ee372ecd3f0a9f95d6cc71c473

SHA256
012a6009a4646d43ea0badd9301ac2ff3f5bc3c5b0c38c4e01f167c5aa08195d

SHA512
c0e1e2c56233fa3c36b2578afe430d8a1914430e3bda220e211dda39a25129e437f296b8ca26225610edb29f4ffbaf4aac81d01860b2bfee0e6dc464dcaf280d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\525685f66d2fa04fc43a1dd400def098745e9813\index.txt

Filesize
146B

MD5
2294fb388a9573b0fc842c1295ed868c

SHA1
ae3593a7967359d0f955000f6375fd7a91ef34d0

SHA256
d0d59c1c2b902f3c8a591b143ac5fefb6c7345dbaa17612b947a7e58dd98f6e0

SHA512
4cc04ac37dba006fc2c361c936fe70ba49655fd9381cb1abcd30ecd6aec4f4dcb23f01c18bddf99f33b1e9cbcc18a310e35ab8d3b89cf0bc180413adecb3f7f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ddb6f92c08d9dcd8c8f6ec920bc7a046

SHA1
f5f4131e0cfc4f1343568b59f849f1d74d9cc387

SHA256
390bf0b8e6b82f218e5f6a5fb07b654808f94ccfbd73f27f960920ba55debe4d

SHA512
b2a3dcb7fe383951f99a19780125de988a02b3e08f9bd7e9dd9cef1efad2e72e2747fa63e56a43dc6a0bb6228be020802ee830dd0167e1c78f23c5d0ce5c876c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fdc9.TMP

Filesize
48B

MD5
3f33120bc5cac5752f6b87cb6b464923

SHA1
f96621dc989773ffb177449d37c2cfa35dea8304

SHA256
e9f233d8adc339450d3c80faaf8fe75383a9f4109b3b0a0481dfd0fcda0bcc18

SHA512
922b772c65d3975c9466ce7b7e3d1b980d232d0c4e7db0fd1dddd9fdf28ec7e4d95c35556eb18d730762c0aa236c1e6b083d9d7445fb1c5b6a096aea75b061bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
866B

MD5
b4d323616487933305231b36ba7ac5ab

SHA1
9b0ae8e3985c97f5877dd5809d99db2974b544b4

SHA256
ae51c4f25ca809d3a4088aebadfd82bb5e5d73f16680874c2f46ceb624d775cc

SHA512
8d8927a412d3a4f23a07497389fba9d9af22b4eda4718f8fb36aec585ee43511ca03a620fcf3af4a243304b3399c3d758034c3303d97e012dcd85e6aa18afe28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
c3b1c1c561598900d1e09f91ae110bc3

SHA1
b313cf06d684b45c7bf161bced0e4226f6c37357

SHA256
6b4094242eb1e488457a45620891f9fe8ef39c0e77604734f8483310bb21b151

SHA512
720d6426ab3029238acda19dbaa892944a0e42a2f4cf91230ea95bf0899153c297ee201172a275cf02aa2bb2b9ec3f365cdb948addd98c0a558f6c2f863769d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
2ffdfa8e15dc6460118965118914ea34

SHA1
6b9fe5a65170e39e743f5792f82987e00f69f049

SHA256
709b8a3440c4c18eec725c88b390e0d78e37e599b008f4d69fae5af9e725c0b3

SHA512
d7d80bc3dda343ec7aa12a6ee894fbd655d4f9f246d59efc86d7b3bbe32b65375665ca36ce13f0183ab9fbb8015f9d7909e8dcf63e01d48bf2484562ba44e04e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801ff.TMP

Filesize
203B

MD5
39cf4c642af9695d6f5ff35be8412353

SHA1
28df60524816fb455eb5aa5bf2a4cfeed39f7a8f

SHA256
ef8a338dbb8afc9f4535d0652d5ede770bcbd2f389d5c1b95d6861ba9f6aea83

SHA512
4841c4135310243200ef8b8df3c53fbef35be9baa76d5dece41732cd3f5d56598581a656c98844b2a9c3677a269deb62378b173cc814315f318bcd9fb1248733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb6bd86f002777a489ad0508a1689774

SHA1
a38993f99d87731be39e88703e15ba0569774c9b

SHA256
0182825bf2cb24962243e8077746a1421c49ad18e3a80341bc7cb493a3ff7c45

SHA512
8a1e30bc3abc88a862dc292e699e6eb28338d5942cf92be61a58ce225e847cc91e0461cf0081f6a45f2f3817c10e8178d2921ca8b8f340867b288437ceda190d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df0705135223ed4989d40d39a9aee11b

SHA1
8754639151ea0545cf044c54058f3d04cbe7b041

SHA256
37a626539aeee46bf3e45ea5a15ee8700912672c67a7800fc1506df644ae804d

SHA512
89ea16eef96f527596271b7f37178c76a85c3522e56734677963aa7fceb2781152b43770ea856f865965a8f62dbf2a3ef16d29db8ad66830cf4b004ab7231566

Download Submit