hxxp://educake[.]co[.]uk

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://educake.co.uk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2280	msedge.exe
2280	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4368	2280	msedge.exe	82
PID 2280 wrote to memory of 4368	2280	msedge.exe	82
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 4820	2280	msedge.exe	84
PID 2280 wrote to memory of 2740	2280	msedge.exe	85
PID 2280 wrote to memory of 2740	2280	msedge.exe	85
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86
PID 2280 wrote to memory of 1476	2280	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://educake.co.uk
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,16977767762519015125,15556888906285767044,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
104KB

MD5
246ed4dedef2b4ecc21503c0d82ec419

SHA1
96fe060665b26657fe8418486895a553be9f5ec8

SHA256
c450c053badfa8425720ae17161cb84d11e1e6a08ae1b7c8e3d2c63a2a956a32

SHA512
3d3501a691477f36d7fc305f8985f4132bcddcd396ae8628173a22a78753bd740621973646ec2e5f1628aa881ac751278a011f0027818a6ee8f74ab2f3278d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
33KB

MD5
a7832bb02242dcad082a37a57d511852

SHA1
7645d8cb3e6e2db068e5aecaf99a76558e7d2186

SHA256
54bd7b78d94f86dedcb6b9dcd65194de0da23ea118ec1e60f26492c3b5a4cc2c

SHA512
b5c8e0dfba62d093e35be900be457865badaf8142a78af65f2235082f9f5ac53d2a8de0c968c861a558e3532f1bdcca6c76ac7ffcf447400751377b2485b41cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
96602b833f58790869b9a8274dcfe0e2

SHA1
b4f1098f01318fd962d02704721fd93e1d467b09

SHA256
eb0af2499422d3a86ae3cfe9f8cac48265cf4546176b6b1a771e06268f8736bd

SHA512
27efea3823b26c17226905b6c6650d13c645e4836dda6b30b0eacd20eb472249b006c48ee3a7c8f2ebfcb9bb18d7100973769f098f8c45a709c6984bc2717e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cc049bda73e9e9d2b7c8402b57d70613

SHA1
8ef0451ad4ef8ed8613cc9949919daf2996d48c8

SHA256
dc68690f3e76fe1e228f5adaa93a0544678f91f92d2fd776104a86e607c35bbd

SHA512
ebbf05d9fc576c87a6e66d6df4344f426f120fd9292281e24bee60d8015e66068b15762e7a9420984d6d087f70b13aa02dc76741fdea8def82d0b1ef35b7e4ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c9a40c65253982233c4a8472c875196c

SHA1
34cf97bd0589147fed3c7560b88cdb5c31725692

SHA256
ac09d0aadead23929aa027767183f00f9a3505109d804a49fdf307c4e1ce6f22

SHA512
718edf433688b0f29475fd0806095ebfc14f495cb1ba395afcf8525eaa9e3299ce3e3eebb66b8df00d3e7f15be7512e1cadf8d42ff8a8306b2608be6b36dd666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
bd6b9d20262a321752642b42440c51c1

SHA1
d079e305574796c7528167bc35f0c5f905c6ab95

SHA256
89536173116cfcca94018ad594cde4dfc6a7747ca6d2d9b827065a847de750a4

SHA512
c7bcf33ecc22b1be40a95d3e302021181473e68856e23baa60e92967e3d068c4b0931960fa06f1fafd9414e57b3481a64019284c8fe50ce78a0117431f002798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
75329b73ff40faa32edbf473a8144796

SHA1
49aabde4789432b7871f335864347152209bb3dd

SHA256
b6ddadece0c6a00814b62f26240f4b0ebfba4312be9392ad9df1ed9bf854c47a

SHA512
228a4fa24afd4dec2f7b140a5ce90bba8aaa9f94f0a251a134075579cc7d844e1a9a00b6f1debdfe4454e3e9506ec75f9104df9bed5eb4b788834401dfe05aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1740fa536b921c17073a5360a5d3c48c

SHA1
c3cec699fe1f63d4c5e7c07787796ea44a332b5d

SHA256
637c81278c05252a71ae4a96316972be0a097e1d3444aff32c5559f9c81e7d41

SHA512
9ea06a55035c9441d6ae3fdc95fbf4385999bb4f5e4eea362c22d094df6afba98480b29f28a75fbd2cf551847a10c897fd99b9022c551b99c73ada6ed45acf48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c73e676f5e27cee1f31bdc950a61a7c6

SHA1
e2524bf4a57f803fbbe4c78f52fa181253072c55

SHA256
897c35ba68add0f6af41929a615ad2edbdbc3de04d0fc7bdd9f1ba0ac01d4ddd

SHA512
c7017f1796d165e01090affab41b2d8a6354e7570777f9e9b79379a41968baaaa7526b0e26a98be1f764fdd01b6b6776150bcf5200256ec7076147ae3eacf0e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7baa8c7c5af2879da450e647812a07d

SHA1
2cc17b75a8e4b751b59154db524c4afeee0d94fc

SHA256
e90a0d50b2726d52094282b705a57431b0efe744285cadf82bea60454e2a0cd3

SHA512
25dafb9f1ee7520e73604a6c05e0f274b2a3f757a5a2847460eeb9f0b147cc5cbc6e235114f55440e96660fe2aa8b0493b7304f1f1f21f81d23c287041ab98ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8da0388f7bbd6ef906c28af61d69bd2d

SHA1
9a7982616de5ca05fa83f4c31b6e6c2a11cbdf06

SHA256
7f1b474114948d6b98b981c831d4e703848fa0aa12036ad292d70918634b084b

SHA512
7bd12090a6e189dc843641de6970b1270b02c95130271ec41bc2901f85a6346ab57786027680062da9c2d1885e85eb57c0703678ff9e0f11231ea4f38b967a54

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit