hxxps://t[.]me/bot4fx

Analysis

max time kernel
612s
max time network
645s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.me/bot4fx

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
3424	msedge.exe
3424	msedge.exe
5964	identity_helper.exe
5964	identity_helper.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 640	3424	msedge.exe	93
PID 3424 wrote to memory of 640	3424	msedge.exe	93
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 5008	3424	msedge.exe	97
PID 3424 wrote to memory of 4224	3424	msedge.exe	96
PID 3424 wrote to memory of 4224	3424	msedge.exe	96
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98
PID 3424 wrote to memory of 2568	3424	msedge.exe	98

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/bot4fx
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffbdcd746f8,0x7ffbdcd74708,0x7ffbdcd74718
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11591696345409161612,13502371540040426748,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.1.110390062\1622139210" -parentBuildID 20221007134813 -prefsHandle 2196 -prefMapHandle 2192 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5a6444a-80d5-4768-adcb-e030db6052b4} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 2208 24de92e3558 socket
1⤵
- Checks processor information in registry
PID:2032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.2.1978471351\1164204239" -childID 1 -isForBrowser -prefsHandle 2780 -prefMapHandle 2796 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f406b349-0d30-4ac0-a14e-c9b55ee5f96f} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 2776 24deceb4d58 tab
1⤵
PID:1464

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.3.1438131373\739162737" -childID 2 -isForBrowser -prefsHandle 3192 -prefMapHandle 2364 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3446e623-f022-4c9e-ae64-3183269e1715} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 928 24ddd373758 tab
1⤵
PID:4084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.4.1738252559\1202757207" -childID 3 -isForBrowser -prefsHandle 3864 -prefMapHandle 3860 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {637c0090-42c6-4fea-bfb4-f437f7df0a8c} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 3876 24ddd365b58 tab
1⤵
PID:1944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.6.2100088905\1048590856" -childID 5 -isForBrowser -prefsHandle 4760 -prefMapHandle 4756 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53c4136d-78bc-414e-b80c-e075b443f865} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 4780 24def645758 tab
1⤵
PID:620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.7.1261181398\491001744" -childID 6 -isForBrowser -prefsHandle 5012 -prefMapHandle 5008 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc207e91-d8cb-4f50-8128-9863b1b53f39} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 5024 24def646958 tab
1⤵
PID:1196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.5.1621825851\1670759735" -childID 4 -isForBrowser -prefsHandle 4744 -prefMapHandle 4740 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {371c544e-03be-4215-b8e0-a844a4deebb1} 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 4752 24deef7c258 tab
1⤵
PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
72B

MD5
f4405aa07de552c3d81dee4a2c4d10b9

SHA1
bf4b85140171f01c9f2e572c469da0b99fc84989

SHA256
f1a608e17e013877be2add5f698f8cf93ffea1900a83c1b51813e2dd850774bc

SHA512
aa104963ca6fb011803031b7c4b22ba680fbd8f657f31b9562ef54c641743a6b68df61a6e01fbfe5de108ec648f7e915ca2c880e4af18388479db22a0223ca89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
442B

MD5
54f700010416326bf02594d49ec9bc7b

SHA1
786ed51e5d79be37798eb53bfea61ab3a83f5d44

SHA256
138695aef3f06fbe333fe3f7df8b979175163b52ca5fdebd84efcb5e3ec7eee2

SHA512
8dada572b6d7c4ce5068720967aec83327d86c7ed613dd6b9ffe3b56682758a5b2c065b09b57b89a24d7df0f56f8df0b5f961fd5db43809d19bc2b32570f6239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5305155309d19506b043ee274c8fc77f

SHA1
44fb8f17e39f66452a74ab6e20cd2b5617ef79f7

SHA256
9e1b1374b37ba2010ba8474e540b1b00f19f51beefabcb66647dd3610eeb01e1

SHA512
d65cd01c360666c067fbcb913c367e47d875f3ac45934b186c7c15dae91f07af0d9344cdc33a8904e368a35da1954ff30a121f325944d0b62e2ce5474ebef646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aaea8dac1465d059363df373aace6ccc

SHA1
d67d1a61525933b15353ab0f67104e5db4b5f431

SHA256
91bc5cc816d9c056f7c5d70d0406701a92da87dceb24b3e670b4dbb8b410f278

SHA512
785c149ab367747f05d8ffe5564e2486717cab2ca9caa48c70e430947f8cd770f76f9706ffa36b40260819bf1514f5cc7735130355a08d367fc1b07d3460a26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df84173904884c3a753f3f90a1990a1a

SHA1
54af8faff90eb0528641cfb756dada3de23fdc6c

SHA256
aeca372dbdd2d0aec2cc334da49508ca6e80e97cc3d58ec35683f41fac5dd130

SHA512
bd5c5c6fe5946ab847f2ce0aa7e3a1f4f93291903ed65223d5b1556da95623c770d9aec02115ba008c6adfbb492e4606443cd449b3f3cb143d0c53e7705762a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b02bc1a2e89493974cf7ac9b48bdee22

SHA1
a0196e9d1285ad4673bf5c19d51557978a8a2758

SHA256
67208a6284b9594187450d6381c3ddf248eedee05ea127d285ad6cce8a5a1c2e

SHA512
26cebc311da3474da78757009cce75452e65ca7097ed39e2f101f324e681b012eda8a127efe02672b4ee0ace9c685027c06ffe238e7e3cd1caa8cc0e9b8d6f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a0f33fd999bb115eb5254ab31f4cebc

SHA1
544184d87c9a5afa2392badff47da54d9178dd84

SHA256
db419a4b38ada14df9f10c6b44192ca11428d3b5eae88561e6b4e7802c08e89a

SHA512
c619a60ef741c350885f35259e096f0ff033299b8ebb01c1a269b1eefaa29aee36eacbf9d8a39dde3d52574f60a874d90cf80e5fe4bf70bc118773ca8c1dd3dc

Download Submit