hxxp://cart[.]takethisoportunitynow[.]com/cart[.]php?crt=cm94yw5hlmtxdhv0awnoqgludhj1bs5jb20=

Analysis

max time kernel
217s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://cart.takethisoportunitynow.com/cart.php?crt=cm94yw5hlmtxdhv0awnoqgludhj1bs5jb20=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-768304381-2824894965-3840216961-1000\{E844E695-6282-4F03-B01E-FD04DC0984EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2004	msedge.exe
2004	msedge.exe
2536	identity_helper.exe
2536	identity_helper.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3932	2004	msedge.exe	50
PID 2004 wrote to memory of 3932	2004	msedge.exe	50
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2116	2004	msedge.exe	89
PID 2004 wrote to memory of 2504	2004	msedge.exe	88
PID 2004 wrote to memory of 2504	2004	msedge.exe	88
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90
PID 2004 wrote to memory of 1896	2004	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cart.takethisoportunitynow.com/cart.php?crt=cm94yw5hlmtxdhv0awnoqgludhj1bs5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb807a46f8,0x7ffb807a4708,0x7ffb807a4718
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7594880815295893677,12188686489823467674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d6ba908-2be8-4b63-84d3-a3ae895539fd.tmp

Filesize
6KB

MD5
cf6b546883245efe1dd0b06f417df46a

SHA1
8f7c5a5c677f0e388f803d0c3ec9c1d1a9aadb16

SHA256
f41e347b7f102deadde82d71895ce0cbbcd0cd32692fb4d5b4c030957744793d

SHA512
fd82d923f9312aa4277bca25f910ed7a7aa6521946e251b93d9e5f739868298da4514f0bdd2e9677b4d9e8d324346807ef30c5166a2a04e5351fb81b5de328b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
ff30e8ff8f673004f3afbbe584852a46

SHA1
2226a55144b289157cb1d074b842487711bdf07e

SHA256
975557fa6457f614c5d732f69169bd93a4724231d73fa26824537a1a61dead6c

SHA512
f6cd303d17272a860470b4a7a5b4b61ed385950eec8b6f65f36d5d92dd86fabe6ce71ecedd4a04ad2bee3f7dd535a852d51a35c0e625eee0e661e6fe6d526b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
4b5d2cf3e92b1b98b9ad429c9c5c04ce

SHA1
7598f04e5614d3bd47fac296fea3a960404a06c7

SHA256
95490c7a9218e2f6d2f4615744d88185a551e954c64db09d74d57526038f6ac8

SHA512
9bfa41b6ad2fd24190c92a1e234cae6a679a9cc4280d5b34c50e6c4e7cb1c513d9ff4ba7dbdb81840ba66d1e869ca56e68d9b499ff696341b0de7fed14fd19d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
95b55458ac749198c42ba829967421f2

SHA1
e693edd25b6817a1537c9ae3920d676d42f8a262

SHA256
255f518cb7d68a116b885acf5738349dd0d0d7664edebd6b7387040252fb330f

SHA512
408b42a6a94b5ec57c5cd8ff39fe1bae2d0644abb6b158a2f5345a81743cfe75b6e90c81c4a6ff856b96ccf57c60e8a472cc4a0d4647409a2010c472717de4af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
911B

MD5
97f722a409446cb0330b6d36e4f3b674

SHA1
5aa2ed483903b3b617dcd00b35d8df946f4de7a1

SHA256
1a9e45c01cbbfeaada1f99418fac447e5546ced4072b01feee51742bd1e7df4b

SHA512
e2568d1119ae3b7cb26e593d3372010cdf08ed3335180fa5cdc99447dad0e005c601a9ea8e57ffe34156b8b6c5b23589750f3fef409ad0864b74146590f3f20e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e7464abf2f33432538565074e3ef58b6

SHA1
00c318f8d524eea0d5aa4887ad082deebc515433

SHA256
2c2c1201d11aa4f8e4b412127200d756eada23c0c7b632f455b983672ac99f45

SHA512
b8b0089f55626ea99808bcef1d8776d9ef0956d0113275eedd9c64e6ba97e797208084631bbe5efab8bf463c14e2fc4430e5905db4108d3ae23a485263cd2566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef3a56a980a2cc3cbfdf40a993f9e672

SHA1
355569a64df6d0c2eb2782baa02242d4f605d339

SHA256
7de1d5c2e040db332890893c6574d3715a58f03689cf6e429769d9eea1ac6062

SHA512
f8bb8a938a600efa4e3cf37161904b3535f86bad5ca951c10398dd68bc497a782d6a44432443598b60b15a20e0404d6e20ef16fba13eb9038bce3313b70fe3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c21be1eb3ab4a4769f26b1e04659e8a4

SHA1
e5ead2c9edd227f42e55236cb5e2cdc8a887bca4

SHA256
4c6b26532cf5c36b0b8e1789c761621ce388b4b2c174992f63c5928aa01d81d6

SHA512
00f9fad16bf3e98f12808150feff14b38041a465784744fc074c2f0732437151188417b239154d63281fac69a8dd8a8a64183dd2184148024303ca185d898cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03c97becf5bb0c25e056569dccaf44e5

SHA1
7d02321259f7d748ba614c3e0d660e8015d7cb1a

SHA256
70e71de206f92ec0b8531968a72f6390d4b52e4c1c0029e93867fde1ab64399c

SHA512
9ad015a0a1823c85bbf5e2b42f4272629b8d0f3db31bbf147d719283833d3d3b8f260a1e51012a18636f3fcf49641e5ea19b6f9b13e2be5a2ad9352dc88977a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8abf8b5727536e85e5be8c28a2a05845

SHA1
6659c952c34c5f30a8fa74d69fb4692ab0802254

SHA256
0b6374d4133108f6012966819e57d3ad5cbf358a93f273e51248d74d37e09f74

SHA512
3bdd27f9b41e37fd90e7752a14a23b59e23d14fe7bb87a8d09331af0df4adc9b3bb0a4007f0743b3bb6b2c340e5858e9caf1438c507a08bd3eedaea577708f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ef99001f51f61bd23929a3b021f5d5ed

SHA1
16c6cb99d574c070ad6d6fe947edfb1d3d53f2b9

SHA256
dc3c7be1faf397d111da1ab746613d284f34d35cfb96b1f71e8d93ed04beaee2

SHA512
498836d1ac5d19bcf33af51a904ca5fd154d6c12f45c8f069abb537a11d335a1e6e03cbb07d611b5a2228a17e7249d1bc97d03c2c30cfc7913ff3038e4458550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59dc2d.TMP

Filesize
370B

MD5
96211da7657be9f9148958078ee8c268

SHA1
c1eb60d8289c8818deb6e707b3e5d0aeb4f2e080

SHA256
c624fbf9080dd6ddcd616a725867057ff105f22c0aa15a6b5cde7d26f6ee18c0

SHA512
643b01be9be0090dbda0f092e773fe968c24f0866f600cfb59fe6cc13eab9aaac46a08e6686f824858dd172d9677a898dac37821e25076799f60183ac1b84ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d7152698c943e06d35650406217157ea

SHA1
3beba4f3405cfc2336f29d6001353aebdef890cb

SHA256
cdb4f9ecf600d77bf4f86c5701a286b6f5a0278b4cb2dbf15d495bae5fd211d7

SHA512
daa628bbc23ad3ba90e80dd8d961ff100d772aa7a4188e9369d81c313c201e2b0ba0defd3032751976027b85e3ee43ce835064ada32d59bf77f2a4921fcfefaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cd16a87e15a13fa163ffd5bd4bd957a9

SHA1
4b92f07223848276db77a2328923eabc0853f2eb

SHA256
95fef21c2e68956cf9f63adc7a7f9bc75310c774f8a7afe2570fa82400d15741

SHA512
6059e630f9ceafe6eb0274e5ac73dc3b5636dde76610dd69aaa54952abb34ad848d59ac4ac0ebdb282b152ffd172c6782f955eed21b08b9334b9be2edfcd0dfa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit