hxxp://loot-link[.]com/s?sQdP

Resubmissions

25/03/2024, 17:59

240325-wkpzdaeg29 1

25/03/2024, 17:51

240325-we8vasee82 1

25/03/2024, 17:45

240325-wb8ecshc5v 1

Analysis

max time kernel
102s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://loot-link.com/s?sQdP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
4212	msedge.exe
4212	msedge.exe
3628	identity_helper.exe
3628	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4352	4212	msedge.exe	87
PID 4212 wrote to memory of 4352	4212	msedge.exe	87
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 4592	4212	msedge.exe	89
PID 4212 wrote to memory of 1376	4212	msedge.exe	90
PID 4212 wrote to memory of 1376	4212	msedge.exe	90
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91
PID 4212 wrote to memory of 5108	4212	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://loot-link.com/s?sQdP
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff363946f8,0x7fff36394708,0x7fff36394718
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15935353876659452401,8984328801214991321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
d4f907eea44e060d5d497d3b366b8f27

SHA1
e7d83eeaaa5e07ae171ef60cbacc23bef25d1f31

SHA256
fa8f81828b4acf1f3416e7d5aeaf8bfa5fca56e86448e0870d864c84716ccd10

SHA512
3c6434ce9292133a6ba2c14b0201826014c43aec733b748b69f0a7d2a0c52937665b2f1bb494e1986d3adff36bd92bccb83e51fef75301fdc6324fce44d0a49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e6a3a4ffad899ad5a06f020cac67787b

SHA1
cf6e6c87f995495f362250017be9a2b0b5ef473c

SHA256
870fdcb98f7f0e882f50fb48791996c5cd4f77ddde01bc45b13970754b90399f

SHA512
13f1e760046ced82083e11cb379c831186f81fcf218f2f7b861d9e75c9cc9a51f077744c1bdfb20e220bc8cc3ed16122673693056f9120d7d9f98ea571863848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5dffd05edeca1def83a05a0941292b48

SHA1
b4475e195d54eca5976e176fcbcca246bd737b5b

SHA256
99a064bfc019f3cc653c61defde5a7ee9539332abce1e818d9033b747153d1ab

SHA512
892bc0582146ea493f275c67f8b951c366381e8302657e1faa69b98fb5a04c4edbe6157c5928f84e9f563535937f91644b6c24682b930116190818403a957aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20b51441058848cb41bf6b0b4cb5b3e3

SHA1
185c75b7f6a7b231e2cec2c82c0905928a09ddbd

SHA256
6b7a6b3ee477dcd9789c3958fd999e9071d2aa36677248046189c222c4c3f22a

SHA512
46fc8a9587b39620c8dffe9515a9f817ef54bb519f5e42c36e0a98e96af3ec4e94c449cf86da82e385c499d640ebeaa73a2d9783b1fc961e0718d3396fba4db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6814b7ee8ac254df1685ad4bc2122c8

SHA1
48afcb762efe998aa9e380eec6b1810fd0e6e6c8

SHA256
5c5ed7ce166d07d5307adc29b8fec492f1a1ce9132bf2560b8234b431353ec0e

SHA512
3ba30cdedb62ce2f5ecf1edaae9098a2602be81cffc517dfe81383aff0fe3b1be80bb786fae312c6de7e0725872fc0f1e2b0911dd4db7b5e07f6420c5b2b8596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
08668641744339047fc9e9e235c5762a

SHA1
8e2e8c8c19734f452267c9c5ca39267d5cc5928d

SHA256
f09139febebf6fac331ca72b0925d5846794c39a6a985ae03b2fa3304af98594

SHA512
195612478a6527823cb17c0de5c38360d705bdd612d637134b4aa915b5893bb4938226ce46ee38f483a099a46bf472a31916251addfe2ae6fccbc845f184fb7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e8e9b7bc696f09bbb62486da27a028a

SHA1
a185b4ad25f91890762394199037380133304bad

SHA256
57c6db630e4ba1a9b3cc9925886978fdccb3c47bf3be1326da355589a4569cdd

SHA512
0bd4cd5b08aa3282d88bce55b39dbbcd09bcf06564b606f7544d60aa1ee5f7a39e7af0c781c3ff5e8b3ee84bef8f2d5e9b1448dff2a6f68d9098fccd8eefcf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
8cd5d37c9f73fc96645621b68bd04497

SHA1
c659e9cac90b2fc755e64c175bce096314ca734d

SHA256
54d4b88ca2f651fd2bdae86afdb4697bdd9e50ecb46aff2d504b69539a290405

SHA512
b1dbfb961561b0d5ba3d225d5362d447dedcacee1b412319eb924966b0eea4d4ccdef642139d5b288e6f13a5aeaec17c3b0b94f38522a5b288d98ed8d87b61d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585b5a.TMP

Filesize
48B

MD5
dd96c25dbef33ff424bd7b434af37686

SHA1
a12a5320b493bd2b86a5ac47b602dca74c3efb1e

SHA256
7bb3cc7c5d1bc8bbd1fbad19ae73dc5bcb2397ff85943726e47142515046e6ab

SHA512
ef9219e795fc9a85b5d5c670b3005bb1ec36ec7fc73d77e3a13979614750819dcc1af59491cb2a57a7bb5816e4bcc95e5ca04d3635fd9168278161604f6d7b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
494f21c5b34ddc7827de89c4e28e9459

SHA1
bab717b4c1ba10bbd9e315dade5203b9cf054caf

SHA256
7311e8c4daefec7787e085af7c691a6c9401ff331a97a09737f27dc306f4fa32

SHA512
a289b517e0c07e0c362198e7b84620aff9126bde287ca145d6ed31fefb94df44f832650ccbe4a859fe0330967cf4b9307abf0819deb580c72bb9427b1c6bf423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bddcaf1ce0333be23d7e0d6741162cb4

SHA1
4484a6644bf62c1a21b948c3b1e7bbf6fc480f82

SHA256
3ab918d2f15172dd45fe5b0b5774b658e25070f284989dc07f72ef22a0d4d822

SHA512
fa0c1f44226c1f389906ea8cae08aea429592f7279d98f337780eb9ae442f69fb4e5b11729e0cdf629bc5503932acfce6a53122d28d3e80d1a8c55e80fef3997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
db3ba7b04328efe7f68fdd204cf24d9d

SHA1
580422cb621c2038e0418255f7bdbced0d2ce7fe

SHA256
260ac9ce04aae2907ff8ba5d9aed69a3b90f4e9002e059655761f3571fb5fb50

SHA512
fbc26e1f3ff136439d73cd5a8313c09e7a159623e6d1e6a58a23d32b20351ed72526b8a6c63aa9b158645adbfec8d80aed5daab784ffffa9684d1a3912863497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb332c0ae2767e41740106c19242e9bd

SHA1
2c3c8206e44e456c0b0b2e9b2dfbc2d5c9906bd0

SHA256
23b73cf50e8dcf4cb04cd0bca5a51441a1b733502d10679658ce3738da40278d

SHA512
caa09084c4ea551a92fb0a8cbe95141e0d44da6e51424e189ecbfda62f947ba25d2b82e47be41a7420da0b27ad23b749e653ada4a9acd2ad4f8d35a82b8337f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582556.TMP

Filesize
538B

MD5
0c8875ff4d89b287b759e76e8264f050

SHA1
38b317741d5d7800e4d73e01bd780af233287c65

SHA256
3123a7e1d1deeb95f9a0363a9b8066c740d99496856226939dad629886d13583

SHA512
d6636ce2f794249689fe928d60e74e5382146e426e91c5860ce8e2c7fbb1498ad60e3bce3d696db8803fa11ab896291117811babbe6c0db8d05ff3a7b5c30d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f16ed87ae159b9992c9e6346c5935ab8

SHA1
e7809fffced7f5c81738cee101bef46f0663ef81

SHA256
cd15e620bd11f00e8e40a2261c7fda0498a07c9ebbef4dbebb86c1be4ac12176

SHA512
e805d22b7ad84a33a59531a821a4f8c2ce190b55906108fd306c909034e394217497e648d772ece0dada28be9b663740138fff9a279bb5f5281373d3a8fdd8f2

Download Submit