hxxp://vidplay[.]online

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://vidplay.online

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
4328	msedge.exe
4328	msedge.exe
1184	identity_helper.exe
1184	identity_helper.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3332	4328	msedge.exe	86
PID 4328 wrote to memory of 3332	4328	msedge.exe	86
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 1084	4328	msedge.exe	88
PID 4328 wrote to memory of 884	4328	msedge.exe	87
PID 4328 wrote to memory of 884	4328	msedge.exe	87
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89
PID 4328 wrote to memory of 3316	4328	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vidplay.online
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa862f46f8,0x7ffa862f4708,0x7ffa862f4718
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,445261395943827580,6896556185787246105,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
7bbfdfaf542b226c2a4f45c6b52e7970

SHA1
681ced22597e6aeccfb6e31125c6190a324a5a8b

SHA256
788962165976905c13e81c5971dbed7c71f7efbca8bcaf236ce465fede6939bc

SHA512
049735b31a5e7be102f3f76ddc69ab38b783c5449433c0b47bf6329c838e444cac894611fc0ee886fbcef1a678487d4048632493c600226e7d58326412d068ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e4d4efacd96ff4ab13a905c485d8356c

SHA1
81f0bf3c57eb08118835d9e65c02631ced1fbaee

SHA256
b1c04b74efa7feaf8ddbe9a9868dd20ca6c760ba5f3169f4b5a617b135c0078b

SHA512
1d10d831902149eac17bee66861c0cf8f975315b53b65bb9fb149b12467cf201fe98d22fa101c5a72fac0e929a7947a4f04bfdd8030e09d96c04154844108f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
13ea1bca5d8c43b927fb52af549ade20

SHA1
4f932bd251ab42e0ba0a01d8098ac77021733823

SHA256
b7266f0224b78ee9a4745b7eaba042a05e24bb55fa2ed0c7daec5979cb62af4f

SHA512
2ef676b5aba6ae4f2cf96471c3d5c3a9d131805ef6545a5b3f0a40cb7b382d4384b88830a604d34be0a33d1e62e50e232bcdf69157981763072d06e55f0883fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
660B

MD5
e5e7b9be33ed780d6b03eb4480a65839

SHA1
a1755c4b6fa7f81ff3be2eee926f460a2551598a

SHA256
6a5cb05fc2898da6082513ddf0ce7b8e08cc1b0af62cdc869c7bea7160424560

SHA512
0f1f36e2ec58c7c5914ccf12d83ef6edd887bbde80d6e11def28a0e89fdca87db985c6861226ba636bf46d87a83a53d3c4fa508a22e99fada4ddf667454c834d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
822B

MD5
43c49f6fb919e101d56791efe520ce7a

SHA1
c84a6b2f093dbea8f03cf7c69f6d979a0060b809

SHA256
54bc1ae070259e858c9806f6152447e9510ffda8ebac1489aa0227a96702b901

SHA512
3ae864ec3be30d4e15158dc87fcb2ecb713347d1bb1789cc9f6e051f6ebd03e38aca8dd688fd982f85229a311ddffb4be44ac86255d7f91a8f78386ec5d0eac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d1c4b67d2b18ba75ffef5df6f00ec92

SHA1
182d2fa416504b9e1ee3d70056c25d524322d006

SHA256
24ba6850720776c4c0f922c0e935f2af3e2f1c1e93882bf857ecb2999bf56aad

SHA512
fbfd607b427a47fa89ecaf75b6bc53f958eb98b946300db0d9cdc3a9efcea7af00d34cb9ab855e2889607393c001c142b7dc1b35efdcbeee8836c1b901778af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d6727fd5587c0a3f587063e4f076da9

SHA1
6e5951b70115b25a449894212eaa4800050d7b09

SHA256
6dcffcd57c771342e012d4907a345794fdda88f491069c09f0f85436486c022c

SHA512
203d68f239bfd9c6a74a07d0fc9f70ef3fb8cafa27fc251560c696711c085a058b5da4e19e5702b2a57e98d5bfc4a5f465826ce4205bdf0809d50a2417092216

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30d11cdaf410ac9a30399670b4ea04df

SHA1
5c396272dcb8fd75f5ef52825727cb57addc72a4

SHA256
173321afde814f70e46393b178ef920b0f2803f097a43db7e9bd520e47f1c5fd

SHA512
6517ca0304cfe2a54e2a8537237f76e90b7fc931131519bd19decc4db92add978b6d1b9a7ae7960840517bd1f65c1dad5540a2d14fa3f1d1ca032de4c0021bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0ef8ce390c781a299c2ac35c7c417884

SHA1
1473987ee0ec636fb256095d0f99d28c34d8fe54

SHA256
2dc1b9c98bf21a4510fb45d9ef6dc1d58504d34a860229b3963cc975902a6f25

SHA512
3fdb7bde94185a3256ed209c12b4aec0657e054c7a078d270ea18ec5d7275b1ad7d4217d2456d894de8b316ff35c65257f27782b5c43044e7ebc8c0f8a6ff9b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
13929e25d8eebe1232a1af5186d4aa45

SHA1
23692504482085cb0a830d2dc3aef72541efbe5e

SHA256
6df8019b3b03741affc7a0082aa33014f9512a446b876813f47d62c488e7c2a3

SHA512
e38a6b1a837cd2f497ec5df0b16410ca469983007d86107f3fac5a24f4a17a46d60888e8f99ce577f24e3f91af80433367af514baab4d99670049d4afde12548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ccb7b7070c5d3f8d554486292e52e563

SHA1
6017389165d43254e8f2ae40435596d7aaff08bd

SHA256
f348023070c04dc27a5108dc3b3f8687617a7ac44966ddc1ba1dbe41e98e7f98

SHA512
a2fb748d86bdbadc74f75ceb7647147fc22c265fa7ade6f034907de1be77b2168ce310f765d85717bd6313ca23f05aed3e8adf18ac6bea69938d9440de139e25

Download Submit