hxxps://dash[.]dimayastrebov[.]website/

Analysis

max time kernel
599s
max time network
604s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dash.dimayastrebov.website/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
844	msedge.exe
844	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe
2348	msedge.exe
2348	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1496	844	msedge.exe	81
PID 844 wrote to memory of 1496	844	msedge.exe	81
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 3472	844	msedge.exe	82
PID 844 wrote to memory of 2496	844	msedge.exe	83
PID 844 wrote to memory of 2496	844	msedge.exe	83
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84
PID 844 wrote to memory of 3664	844	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dash.dimayastrebov.website/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb0af3cb8,0x7ffeb0af3cc8,0x7ffeb0af3cd8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11231571984551662964,4483227021447922777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1a9c7fa806c60a3c2ed8a7829b1461f

SHA1
376cafc1b1b6b2a70cd56455124554c21b25c683

SHA256
1eb39b1409ce78188c133089bf3660393ac043b5baade7ff322df5a0ca95380b

SHA512
e1cb2f84b5cbd86b107c0a9ec0356ab65a54c91208f9f8e83fec64bf17ae89356a09b0cd39d2726424f4041d7b25b962c23672b8645c2e10f11ff4d2075f4afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f3f6e86c8b7bdc605f5559df800bfd34

SHA1
862d05bfba760ae8adcbb509216dc18ead59a6b2

SHA256
5dfe9be21d4916615025055f1a70151362bdb404b40f074685e39b33ad545a78

SHA512
de576ebf0cbe1c5e7639c42517253796cf4b5770298271ac2e6958404998f2d6b8e3378a535f2f316f4020fd8e60b5cc9c1b6b5171d307ca3215afe8ac47a7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\761de77cd7142268_0

Filesize
212B

MD5
12222ac5bc31db9eaffe10e0fc047c88

SHA1
3859d561292fc544838e0850303e312e86056638

SHA256
2c0a279725dc82df084fbd3e5a495e8b0f1c7ff370124c56ef8c29af5497d00c

SHA512
9e76c8bf718061789d06aaa3348254229dc242b919e8965087aab5d9eb9513da4d2cd9d203c6c871c90cb16de68361309912e18e272c225e3544b1ef9981ec36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
35290fefbf0bc5fae0d0e858365ab174

SHA1
2eb795790b1f6a8c80d3f3d697efae302cca4ece

SHA256
d7805184b20880691b88c913dfb64d41425857bad2a25eedf5330ca1909b1d94

SHA512
274751de8c287f32dfc9a2ec405eea663af7bc103b78615658c64b166758a8dad46fb110cf64480c34f64ba1563371d8b94cfe9c90551bd04f9ff8ac455992a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
af6108184c5b86bdb2afdca7c7e95c3c

SHA1
ef0e9ff871f29957ead4a29b5263d4edc560cd54

SHA256
4876561a32cc01c00c14e1146052372349bb6c1f9f07e05e59657b240c489719

SHA512
fff5b446dd43d42afa5a072095537ceb50c050213c90e9b76a99d7bc841c8ab958603c685a5cdd00ab087fc48c0cf54f6ccac24a8bede9aa4c7e994e175d3405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
474B

MD5
a030ae45b5fa576c213871b03df09338

SHA1
ea7e53ed84275e70331b35990bdabcf011c4910b

SHA256
90e36e7f346644b717b18f1c68816e54d10c138657da03cce6fc641cb6e2fce7

SHA512
f1acd783c60222275f524b0c36aae7daa60686c40fdde750158f7c01c8d3f3c906f426415dcc437c1db45858762c4a5fc480e8c74ccbe9f9248905ccddae7ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
388B

MD5
f04db300fcf9a5dccd8f2d47e0104ea3

SHA1
9066336c8ef2ca4414008f44b6c55cda0478d431

SHA256
c7d8739224d4695f0fb67b1cffea75b64e04f92ce60d23b0a000e0a29f971b36

SHA512
d2a2d73b282ec612a1439f2b05770e2beaf30a2b14bd022377b77fb35fcac5f6001ade74ba133906c4827329224c04f86a4a7c1351677651a6f84fcb5ab153fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
116B

MD5
a4241c693fbb0890faa305764d6cf50d

SHA1
e856d3421567a3cfd8d790825d6952ba524fe463

SHA256
197eaf026300dfbba19cdaa31982c92741d973f655d875b6362246d6f89d07df

SHA512
7e9cdeb74e86bbb4afcf620a148f82a03f38d3a0d370ea37143e7cffce45109b5bb7638aaa77c97505d046a8ac4ec6f9e4dd630c54ffb44b57296d066d308bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
474B

MD5
baa0c512ccb5bb7c0da273a8aa5a088c

SHA1
a264decb07fd30233d7246e734e8e590f73a7aaf

SHA256
fe21014ba56f49792bfea1bdaea9ffddaa18e5692b2f027794d5f768305e206e

SHA512
6ba9af2d6c0c4259d65420a41a2ab569b79daf4ae70deec5bc602bb992dfc0c2f12d5bc20ec60455c46808a27b383a469a0edc574f079c8fa9bece326ea563ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
383B

MD5
2840bf674696dafe06d0d001577fc51e

SHA1
aee66ba58408ab226ba4aa39cf3c0712d7ab9d82

SHA256
36308db36b23f981820fd1e5991626f811387c0f8db2b1ca1fe5af48057a0d79

SHA512
26585647f5df6b07a70432f38c181e6bfb7b6a591ac17a9764472fe0c75da16891f620b9a1c7a45c17ac5b471354c02e03516a8a6959053a449f4f66a9d44548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
474B

MD5
6153d681368d86e6f9f4e18392c9888f

SHA1
743f5eddb256ef2c7158845f18d2deb9ae19a57a

SHA256
49b06bf8db611744f733db6c748792eb15c0f95480d5730ce4432222e404ae1c

SHA512
148ed8ca09bf32cab39702ee08cf860ab98558bef29feecd60d3e66c55b171b2205e66841799e41ee89c6bc6b44b88b553c0aa53a3d754c02e8c94c579a65c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36e5f4add7dbd7e63c7e1ad725c84ef0

SHA1
0980546a1d081e56de393e67761e184bd9b891a1

SHA256
80f173e5ecc60f49ac10db1d25fdeeeb957ec3ed32a057ef75f923798a139251

SHA512
31e8d04cc7079e9938425678e54f14c09cda525399a9043281a29302b606884d32129d4694e35aec9f1b1b14b87b0587337a2399c84194db44a6c56d53b0661c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c6e15dcc8b201de016dc7e3f4f78050

SHA1
068368a655f6c6370d91a91f811e106fc85c7cdc

SHA256
76df7db82fb0c343c04f0293c951781d15a62235cd303fec3f793692cad91f69

SHA512
2a9a10448d617ec76c85f066a5c9e3740cdfdd77fdbb1b9231e2ea59bb61dce5dde19db38b54e8926493039b1685cdd96a5971d5e6654327b3d082c79d70a8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13358126175300323

Filesize
138KB

MD5
c923eb5ca589a25a84a6ae2a6aaf4ec9

SHA1
255f4419d6cf5c062e2d382dab951793320b5b0c

SHA256
e27ad331cbc4b9b34abb595180ac840aa9a5323f9b5570ee6812492d38dca0b6

SHA512
806568e355054248b814423b671966a9ae3045516a872ce50c57f5e86a5e6517a3f9b2b2e29107af494a015d2cf6cde412241c527e4452da59d5d1bc3a5b082e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
586b14481623c5dbdbe7e84967134b05

SHA1
930428bf593e51c0ba0a52c4e5911a7f48031b95

SHA256
c86dbb0a5b10d11ec3641b347cc6a1eb787d12a8a3e13e334b43a8b09b4a7e6b

SHA512
b3632d0efb2e9b9abb61fb04d3a41b79fcf0fbe7460521d6cfc9e838a82a6d2034ab8d6a9405ba5bde46a0ff9160b73a152a7a4a3994d8c52cd65c0b975e56cf

Download Submit