hxxps://flash[.]vendexhosting[.]nl

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://flash.vendexhosting.nl

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2936	identity_helper.exe
2936	identity_helper.exe
5600	msedge.exe
5600	msedge.exe
5600	msedge.exe
5600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5128	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3552	2788	msedge.exe	84
PID 2788 wrote to memory of 3552	2788	msedge.exe	84
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 2052	2788	msedge.exe	85
PID 2788 wrote to memory of 1792	2788	msedge.exe	86
PID 2788 wrote to memory of 1792	2788	msedge.exe	86
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87
PID 2788 wrote to memory of 3908	2788	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flash.vendexhosting.nl
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2085925947052025794,14124737082591559953,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
1024KB

MD5
54bfd046b1847fd4da77b22972d2edab

SHA1
20aaeafde8f7c37f6d8f8d46cf6f9010377d859f

SHA256
a6bc90158be5a17e1dc1b23f62afd7cde74d08f6ab599e01de051562def3cf09

SHA512
63b94b380382c703322ff23f9f358ab12dde58dab0f5b6715c3c8acdad60b1c2dd5badb5c24c1baf6f6ccf3e711e34b392e3d22ff0bf9703e92eb13e0b5f5f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
66e91efef5c2476e38b17847e007db52

SHA1
d69832d37173d26d1c1ea93dc1cc492cf864579c

SHA256
515b3153db3a2b16a21cebefb57af86d604e87e3cff21c6ac8db1f4bb07c46d3

SHA512
5793233856bc28df45c860ec3532c3ba624e51c7b89d81d0cbe97a82af56c21a80765eaeda745819fe8ebfe8a2dd8326ebfe69fc8baa09459a131f9a164e0dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a7c5e38fb64024fb9c930b5cd0799c7

SHA1
7a63abcbd228959a21b3c0bbba094f8bb656f5c5

SHA256
642639b28a61f5f8ac727ff7243fbda7b0a5ecd42c6e303419e4628719e92057

SHA512
84e9127b09c2ebe021219a327031c35c3a03fb80932396dc3935703de8ed0bbe77df3e3e120c97df00d565c1a8e01a7392c2aba548a148773b27eb1687e1d164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
13ba2f27d78777a8322448b10ec14ff3

SHA1
a9408250f9bdf97c665a59b5d459ae82429413ed

SHA256
752bcab9d21589f4459b00ffe854d0f79c80195d604b4e9bb8395f5bdf7c4209

SHA512
7b1e25572687fccc0c5e6720b257e18ec9242cfc8ec365c1381d75bab80937aad2d0fd9bccfeb50cffd7033d1c112c9dc9e31ad80c4fef01b440b207eea32492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1f5e3bea4abdad16b96efc8a63f6ecb

SHA1
c2e892e709d74f392d89c35952cfbd171f64d08c

SHA256
3f501d40c036994bee817f052d464683cf208c31b9504961d7bf2dc259a8a124

SHA512
2e0f0932563f0830109b22ede193d8476659958a1db854d1913070865b7d0be89bbd7cbc01d82062fa03da204474698e13f59d5e33de1eb9d895ecf4baf03e0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a450760eaba303dd54213d5a79c9e35f

SHA1
3c3265baa62d8e287cd8e89b6b531169969bdf1c

SHA256
56394530016f4fa60ee4c8c2b8a6b15aabcf95dd39bf57447ccf3435b92345c1

SHA512
db005cc4608a00fe0441537c4371e0049726bf33bb8b65db32b45ad0244c4e0817d731c0662ea8f6ca65cdf37897351ec56c28795849f818aa14797cde3a6f90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca1fa1e5fb3278dc06d850309b2e7964

SHA1
58d736438dec64bd2292fb38d13f2041b2923969

SHA256
514226f4ec9fa896dd4b40730991ebef64cbaca95e8be7f8e9791be9f3da5565

SHA512
4c2c0e19b2ee1aedad4579f9149c6a187384faeea95aa8772d7e250dfc71568a80ed6ca0502fce83ce4b60d6241d081b021dfa862f56cbf238643a67e6754676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f557a6a1426525b9890b378f0381283

SHA1
68c0b79685f7a9621fb1aea1197e02628b586fed

SHA256
54a932f2d827fdcc8a1d56aaf7e0b1daa597200124ef8b3f65aefd8e821e8606

SHA512
315a0146ecb24fa9d8d78b294885e9e62609352e0bd9f8f62a705d8c50c91bebb4accdfde127b0a3fe8bd131b16e5292af984d08b5f9ed39e41ec7a749f3a7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
fd03069fa3ad2056b76c0c22cf9a44e3

SHA1
8d0f39f2d3bc590cf72439899e57784983758955

SHA256
cab461c86a6cf89615dec18d0ac9cba2de0ae9d73166c61de62c441d278966c3

SHA512
73eee9dae29851112651ab18d32e17afcf8fade4173dc534601ffa94fa23c32241d3fe7de5196c791fe4c0c8262ee176acb19b6dd90bb82273a89a089c403603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b1dfcbfc-99b3-4a75-a8f2-ac65d68b8acc.tmp

Filesize
539B

MD5
ac94c8eae5c1d77cbb413745d06de95c

SHA1
dcdfb16bdda44eebbde863db1531fb7cb179cc43

SHA256
7996bcbde465280ea57bc080c6c2ed2343f0d1528ef01f48d654de2c153d5321

SHA512
b0981edfc919ec52bfe2cc5bf91a94581a414f55035b4f99d6bf4e4f5789a6827d674a67e5898c1c090310a93589d6949939514005440b05a268098743c2f85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d87483bf532fcd7a7f7a250fa6a78fbd

SHA1
0f96b58b0b419b8b994ca0bd163dc12270136f96

SHA256
04e3fa224e3d85b1ea8796a609af763d87d76704ec62c5ce09eb1696aa33882c

SHA512
191ad71d5d364901745d798031724f20e042a17d2bad114e45e88c27f0c8176f44342b3780a9d42f87437addd6b727b599f8abf85261f81bafbbbc7437171f27

Download Submit