hxxps://spf[.]hotmazells[.]de/i26/

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://spf.hotmazells.de/i26/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
5016	msedge.exe
5016	msedge.exe
1184	identity_helper.exe
1184	identity_helper.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3000	5016	msedge.exe	89
PID 5016 wrote to memory of 3000	5016	msedge.exe	89
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 864	5016	msedge.exe	90
PID 5016 wrote to memory of 4772	5016	msedge.exe	91
PID 5016 wrote to memory of 4772	5016	msedge.exe	91
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92
PID 5016 wrote to memory of 4624	5016	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://spf.hotmazells.de/i26/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8028b46f8,0x7ff8028b4708,0x7ff8028b4718
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9097265796331126720,1404738963631065964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x51c
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4f424deef3825ae9795bdd9fdd431e30

SHA1
85f1c354f6e6e6ed115c0a3fcc6a8486bf26837a

SHA256
a596c831c34f1cb9d02b02e4de68ac658c3f5535c1aee2bf622dc14a334a701f

SHA512
16196eddcece8eb66679f18a9707d668f515296139f88ff0f3c88e06a8c9f18af7e3f5a3ec14f13db021688451dd794384abcabce87a0cca17959f1246b9fe97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
849437cbdadf0c006b2798477f6979cc

SHA1
e31593908a83da63cfdd2dcbe3ec00bdd8880a23

SHA256
352470e177950d14bd5934b09bc9609546922ff0dfb2bcd1ea39421f8940bada

SHA512
fae3bc9a05c9e8341ac9f530e86b543c6b70e41544b09589f859f38db1b48300dfa67087fa0a0fbf7f8ab1b84dd89f0bd30ed3344dca9c1656d838307115b9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
df87073d01dbe3e1e757cedf6c6a288d

SHA1
365f2436db7dc5658fbef89d56c084dcda30379a

SHA256
4cca8eaf680cae71f894daf866d56e88e6700d74dec461cd535b2081f46db6dd

SHA512
87f60d4d2c9264a78dc2d859590999fffb58d634e5237ca3fdad389f7744b59db3c7a6b1f2032055350d946c2c7a10a61733e7d158389e3f1ea435972a80a105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb306c4cf8e8f7bae0958add8cd7af2e

SHA1
ba5d3c94f3dd67c92e5b4a0f676139d2a0c0a8bf

SHA256
e6459cee55925b58a5b2f646b8dd710caae0ea477193c033e03301209f7c0e9f

SHA512
59b7410d2b1442baedac4b07b5a39ca0d9e78384c02e5342fc8647965a666f6e04cc565466569ea71056bfe0b6d006370641855163e6a2316242f7e8b1e724a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fbc40b6b6d80126a739fd21136bb3f8

SHA1
0c2acab6c53c3efe5fb07a6e6956eff06183221e

SHA256
53dea831a71c6abc154d9150348b48bebc4cfa5a68256f2ca5bcb1ec6601654c

SHA512
6cc5ee553a3fef72552be4e9eaa8c4eddb9300c4faec4cc700de468d693c79b44b42f6c73c43352050ec01307993e64083b616f63df25e64c5483becdfd00e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fdc83cf72c8b5ddce60ead495ecffff2

SHA1
2ac19772ace43a6d05efdadeaa8a656bd5c9053e

SHA256
db3fdf2a79f53d81b4e606bb01ec8344e8bb80b6d21113d9bee99e7f0094783d

SHA512
cd69c69a73054962022c4a4012b6616c39dcb1ee99f1845a223106980c2306daf2927c973b74b5ff11326940d0dc969eaa1973ad205346a0f233193f4487194f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ecbf5214c527d4daaaf4aeb7ef045c79

SHA1
a5ee372a2126e82ee4d7e209fb4296935c81898d

SHA256
8ead34f0a3dcc1363c5176dc1a8ccbafc20f958f559a6b44f9f99ee9e429bea3

SHA512
d82a10ab8407fde4b8b6ee15c815baad2fec687cd53fab2e765c8e56b4799c0ac0b5b3d18c508750e96fb2bd9706c351020f3b52ca32edbc4c1358323abd9a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5862dc.TMP

Filesize
48B

MD5
f1e60f73033cb731b1d37faec25a076b

SHA1
59dfd2ac6334a835f1eb8ce4b3873662cf929c5e

SHA256
b9b68e33037b5888f18d7ffb6502c695257e9e336873ce2dbc4284a2e693d776

SHA512
95a8444e20ca718e006921e7a7a41617b67a72bd1d4da2ba626fb92886a315b0ac76dda75c0c3dc4052e45b7e27e800076e4d0a34db0888d42ddbbb237633d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8e8e2d4fa89d1e5d88e96ed727b676b4

SHA1
dee0bb18c7c7617b4dff74a4a8acf8e9fde5163e

SHA256
bef17d94857da933d84e4c1a6c2240e209da046907892eebf51d5e1da6740325

SHA512
ad5f0be2289239821648f6d3295fe4189c434563d4d71c0638218dc35cfef712f6fc4ac1626f71082886a4132a23fc7149722977a22d30f8d8c61b27c216b030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
65250df4eb891df6f5dca2d8b3bf3fe8

SHA1
d7eb3129a43f1ddf3929c3790c7dd76f739db504

SHA256
7f6426003142bf28ef2bce03cd51aaad5a0d0bbaa554d23045ce08c68b4902aa

SHA512
2cba21f49893574cfc52c8abb0e6ff73c9bb0be775596213748cf4545cf9716f7dec9cac6083acd6e58a719add7e2b533dc97bf67ddfa907759e0d56a004b9a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5806e1.TMP

Filesize
1KB

MD5
19a50c1ea2e6dde4ab6e166f19cebf85

SHA1
0d29e58bb4ad6d19b38878553a6db2954d91b4eb

SHA256
506fdd5994d50a4c817ef6f7b40bb7cdbc2539de0d902f6da87cc7360b87732d

SHA512
0c505a9d5b390a13b285c3d7eb9af6b8e93bfe1a1f61edafa7096e4c0b74ec7ed297e2810760f283fa84e1e6c677ca609202f193c740ddd3e46dfbea27d786a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2739e22f816d2bc0a4aa2bafafbd9108

SHA1
6b37775471d054d7b3276ffd9f12a14ee9a72247

SHA256
b4c03cd9957f68d947f0226db711f36332fa1714cd66e781805cffc342ee4d8a

SHA512
62955798c6f3416163021e4c4fab6013ae4b9b23bfbb82daee09101ec7ab80243e27557bb7bac618b73eaeecfa4320f81ddde7501209e106389b18327f9a8111

Download Submit