hxxp://alphadex[.]io

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://alphadex.io

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
90	raw.githubusercontent.com
93	raw.githubusercontent.com
94	raw.githubusercontent.com
99	raw.githubusercontent.com
102	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
4752	msedge.exe
4752	msedge.exe
4188	identity_helper.exe
4188	identity_helper.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 3144	4752	msedge.exe	83
PID 4752 wrote to memory of 3144	4752	msedge.exe	83
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 2772	4752	msedge.exe	84
PID 4752 wrote to memory of 3088	4752	msedge.exe	85
PID 4752 wrote to memory of 3088	4752	msedge.exe	85
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86
PID 4752 wrote to memory of 1052	4752	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://alphadex.io
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0b9946f8,0x7ffb0b994708,0x7ffb0b994718
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1128 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,944526125096616473,6393796641881322117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
39561f541060c129486061b025d170de

SHA1
133a86f9a3080345136dbc75e5b750e4c03e2dbb

SHA256
b097294c4f6a86453c5bc92b9b1f4d5f06198e85627f4d6ca4f4b4aa8a17f488

SHA512
76ccda3b82f9ceef9a77043d34ec9457f6b3b3159fb321a5636bcc2ad23f92528370351e22d21a42f413de2e1440f1dc5ca626c22c24a5cffe5b2c368b0f1ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
cf9ca6507cd557c4e9f2dbdeaa88548a

SHA1
ad2016ee1eb8b594d971a2b767ce42aa31c89921

SHA256
5291b4da29557a50d771d8deacc969b7007d1e194a1144f818931c3626bb7d1c

SHA512
6ceae1848441c42ae5ed200f28748e4f514e2d9fb9bddfb27fcea6c6d127aa7e4f54ee9e50e401482d10793d9562c1c76fa295253b110dd15b83300c4ba773c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
726b81c86dcbbec8b1894f095b2585c6

SHA1
8777cacb0e33e5bfca2b3bca5192d428fdf2a4fd

SHA256
89bb9ada7d187bbaf967b52efc7dc66d83131d03b039497418a6b85ab03760a5

SHA512
33397f41bcb247317f1d8d2d8ec6958cb0c3cb57c736e4f78939e287fce13e37953fb442510d4c7a79187c051664aac234d577327e9e443f8f116731654d12c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ef225a56d969f18b179af2504f96447f

SHA1
1dc862658cc342f90bbb18074ec9267a489b364f

SHA256
2f599c6af1df5861fbf597156171d5fdacea19c367d5cd5897125282b3ae2773

SHA512
459f20bf97c2caa4b9847fb5e4d8cb0ba97710136ee5599576df9599de753113aa720c7a0ce61e7fef5af246c902c2b8c4892bf1cfa1c19e455fe90e0c558dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34dbdf131a3e55c81175b8f49bc2e940

SHA1
be3829ecd0f380dbe119bbe3c49cc852d4ac86da

SHA256
d7ed7f7cca8c12ed5530b7b62876005b5ec5a58a776ef635b43cf0160a0db4c2

SHA512
acaa5e6dbca61e3ccf84c16bda44d7500566587d84fec7c72f9c2648c6878e2a27f51a1b8ddd7717a5f807b362891856e86350a47267c5022ef41092f7419cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5968f0fe1a25a8753ac0862e13c82e94

SHA1
193cfcf8ad0523b90fbae954ca7a36ba09586e47

SHA256
fc8af7788448159d4f50c6087c981431c393c2a866917784dc81dc7efcb88cf5

SHA512
109237a66bbb376c508f88eec8bf1361e5968920d4367d5bda0357b621428252d36bec3b9d36aebb86912f1b284eddb4280d3722970b0ca2554c617650497f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b215ffe2b175cd4a102a9b9610863087

SHA1
f469c4ff33f23ed71b9f99cfbebed32db0f13f19

SHA256
278e19eabd50afd4120c6ad779bd41d6c1d7b240b9d3a4ade5b98b3907e1c452

SHA512
c8e6b5cffeb5b879f20e2e4cd144704f9b0ceec13dcbcf5494e7cc1648a5b153305feb23c23de236b9792abe64c1c0300437621f4a6bd234cd093dfa6e4d5231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\dbd4d2815dcc5c45e50b032647e5b0a51d45d4f1\91928898-6850-466f-954f-b766d867d0cf\index-dir\the-real-index

Filesize
72B

MD5
034856cab5a964411de90cc6ec49d399

SHA1
f1befde853371877978b357fbcd31dbff4d742c8

SHA256
875fda64f679dba260608323b9fe7df301549af0d0f574efe340b50c44166dbf

SHA512
3173f53755feecc3387190b7e7fe21b3bdd6e2e3705852807019888a5e42bbeaeee3f9b66327d9b281332bc5dfdfb4b48dcd6c92f8bbd7df69a76b36446c81f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\dbd4d2815dcc5c45e50b032647e5b0a51d45d4f1\91928898-6850-466f-954f-b766d867d0cf\index-dir\the-real-index~RFe57c37f.TMP

Filesize
48B

MD5
cf416cc422633f2c8e7ed16a0bb970aa

SHA1
e73ac5cc2fdf5e915202f69b29848806da69dbab

SHA256
d46584dee3b600880c45adf353015f41fd48b411877759655e55bf6b6de1bd03

SHA512
3dac37ab9f8e36431bf7027aef1b1652150c4d76666c7c91c09e4b352bbcc45bbf97e666994cd27e521eb076c46c7b79d161395908ad9644ec6b63178bd9d689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\dbd4d2815dcc5c45e50b032647e5b0a51d45d4f1\index.txt

Filesize
90B

MD5
48e55fe25ea7608b9db722f8900a4809

SHA1
45ceaed136f884bac2ad4218ad131ceaac01ea84

SHA256
bc84cb94c56a58507e2a9be589a5e0cdc31b356d8fdddaba80328c813f6d8f67

SHA512
c4c8f49890a4ff7344963c26789cdf6ce3ac74dd3f7320bebd768dedd4d942963f03e75b3dd9e4666f500a1cc34394f5edd079623ddb89060be98c44fa1bae16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\dbd4d2815dcc5c45e50b032647e5b0a51d45d4f1\index.txt

Filesize
84B

MD5
d2131e8018acc5afba2240abbad7c6c8

SHA1
210fcb963d763e566bf89755e12b9e31e805541e

SHA256
4226aaddb66f43caf7d6221d6c8fb2bcc4d139c9566b0f56416fc91688628037

SHA512
4efd100cfe5e8723f33964488e0034250a82e76cbc5a439bc72a47a51ca37ee107bfd70a9ff8977a076093132948e9a19c0d49041317a3420659e5b994d872a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c88815e75b096fc401bc3dea5a015f84

SHA1
9f92c9585aedcf87bb7d08b4557449a3488949b1

SHA256
c02a94968bd145d54006df35cdff23d1297824260497fe93fc98128268497737

SHA512
af1f46abc2aedb41dcdc6fe8022c06f9b73c5c802c0c322235bff595197041c42d500edf5350d21098354c20a1f14232b3d5377bef4bac8df85f6fea7301bc50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c786.TMP

Filesize
873B

MD5
0390adfad086cb351f4f84124eb86d3a

SHA1
75a2a4000fce8990841c08af8c80d6de1c1ef74c

SHA256
0f20b7007b16219b8c83d7096daca9fbb6a7f1d9a4c8060e43a6de2bdf21397d

SHA512
6f2b619764527256c15e99f7ff1bcaec2f0b9260a84359bf81af11fddbb6f3357b79d958b41c227341beb8f40444d5056277d99565730739a6cda3e031973e34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83674758c47243f23840334780ea50d4

SHA1
666020b848dcf0b2dd55e8dbb1d43d241ae1c1ab

SHA256
cc831b35c1b8782c3c8c78e38815b8ccdc64b8e9e5ac0883744c6737bde4964d

SHA512
d99ccb5b1ad38dfc13ac1506daf4b8efeffed292ecd89a3a42706f1ce6908b7d3f705c0d2d98240bcab7d9d83f27b56d63e674feff9223b9a70afe7508d41a6e

Download Submit